Windows Exploitation Techniques: Dangling COM Object Registrations

A privilege escalation vulnerability in Windows, tracked as CVE-2026-66804, stems from a dangling COM object registration for the CrossDevice COM object. The registration points to a non-existent DLL in a user-writable directory (%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll), enabling DLL planting. An attacker can exploit this by creating a malicious DLL and triggering its load via custom COM marshaling. A specific COM service, 'Shell Create Object Handler' (CLSID {135fd325-45b7-4c30-89f8-4386961669f0}), running as SYSTEM and allowing custom marshaling, is abused to achieve privilege escalation by passing a crafted OBJREF referencing the dangling CLSID.

AI-extracted · verify before operational use