Executive Summary
A privilege escalation vulnerability (CVE-2026-66804) was discovered in Windows resulting from an incomplete fix for a previous bug known as 'Dark Elevator' (CVE-2026-50343). The flaw resides in a dangling COM object registration for the CrossDevice service, which points to a non-existent DLL located in a user-writable directory (C:\ProgramData). Because this directory allows arbitrary file creation by standard users, an attacker can place a malicious DLL in the expected path to intercept COM instantiation requests.
Technical analysis reveals that despite modern mitigations like EOAC_NO_CUSTOM_MARSHAL, certain privileged services such as the 'Shell Create Object Handler' (CLSID {135fd325-45b7-4c30-89f8-4386961669f0}) remain vulnerable to custom COM marshaling attacks. By leveraging a scheduled task to start this service as SYSTEM and sending a crafted OBJREF, attackers can force the privileged process to unmarshal a custom object, leading to the loading of the planted malicious DLL and subsequent code execution.
This vulnerability highlights the persistent risk of 'dangling' references in the Windows registry and the complexity of securing legacy COM infrastructure. Organizations should prioritize applying official Microsoft patches that address these dangling registrations to prevent local attackers from gaining full administrative control.