This article examines CVE-2026-66804, a Windows privilege escalation vulnerability resulting from an incomplete fix for the "Dark Elevator" bug. The flaw involves a dangling COM object registration that points to a non-existent DLL within the %PROGRAMDATA% directory. Because this directory typically allows any user to create subfolders, an attacker can plant a malicious DLL to be loaded by a privileged process.
The exploitation involves leveraging custom COM marshaling to bypass security mitigations. By identifying the "Shell Create Object Handler" service—a SYSTEM-level process that does not strictly enforce unmarshaling policies—researchers can trigger the loading of the planted DLL. The post details the technical requirements for instantiating this service and provides a PowerShell script for identifying other vulnerable dangling COM registrations.
Top comments (0)