Critical Windows COM Vulnerability (CVE-2024-XXXX) Allows SYSTEM Access

Key Takeaways

• A critical Windows COM vulnerability, identified as CVE-2026-66804, allows authenticated local users to achieve SYSTEM-level privileges.
• The flaw exploits a specific COM object within the Shell Create Object Handler that improperly handles custom marshaling.
• The vulnerability has a CVSS score of 7.8 (High severity) and requires no user interaction for exploitation.
• Proof-of-concept exploits and commercial modules are publicly available, increasing immediate risk.
• Microsoft released a patch in the August 2026 cumulative updates to address this issue.

New Windows COM Vulnerability Grants SYSTEM Privileges Through Dangling Registration

A significant security flaw, tracked as CVE-2026-66804, has been uncovered in Microsoft Windows, enabling authenticated local attackers to escalate privileges to SYSTEM level. This high-severity vulnerability, rated with a CVSS score of 7.8, exploits a weakness in how Windows handles COM object marshaling and unmarshaling, specifically targeting a “dangling” COM registration.

The Mechanics of the Exploit

The Common Object Model (COM) typically marshals objects by reference. However, objects implementing the IMarshal interface possess the capability to opt for marshal-by-value, allowing them to specify an arbitrary Class ID (CLSID) to be loaded during the unmarshaling process. Attackers can leverage this mechanism by directing the specified CLSID to a “dangling” CrossDevice class. This manipulation forces a privileged process to load a malicious DLL automatically, prior to the execution of the intended target method.

Microsoft had previously implemented safeguards to mitigate such abuses. Since Windows 8, services can disable custom marshaling by utilizing the EOAC_NO_CUSTOM_MARSHAL flag within CoInitializeSecurity or by employing the more robust COMGLB_UNMARSHALING_POLICY_STRONG setting via IGlobalOptions::Set. For an attack to succeed, therefore, a privileged SYSTEM COM server must exist that has not enabled these critical hardening controls.

Identifying the Vulnerable Target

Security researchers successfully identified such a vulnerable target in the Shell Create Object Handler object, specifically CLSID 135fd325-45b7-4c30-89f8-4386961669f0. This component, which has been the subject of prior security analysis and exploitation, executes within a SYSTEM dllhost process and, crucially, still permits custom marshaling. Due to the absence of a direct backing service, this object cannot be instantiated directly. Instead, it must be activated through the user-startable MicrosoftWindowsShellCreateObjectTask scheduled task, maintained alive by a global ShellCreateObjectTaskReadyEvent.

Once the SYSTEM server is operational, the exploit proceeds by simply passing a fabricated marshaled object through the object’s sole ICreateObject interface. This action triggers an unconditional unmarshaling process, leading to the loading of the attacker’s malicious DLL directly into the SYSTEM process, thereby achieving full privilege escalation.

Real-World Risk and Mitigation

The severity of CVE-2026-66804 is heightened by the public availability of proof-of-concept exploit code. Furthermore, at least one commercial exploitation module has emerged that automates the LOCAL SERVICE-to-SYSTEM privilege escalation chain, underscoring the immediate and practical risk to unpatched systems. Microsoft has addressed this vulnerability in its August 2026 cumulative updates. The patch specifically removes the dangling registration that facilitates this attack vector.

Beyond this specific fix, the research serves as a critical reminder of the ongoing threat posed by dangling COM registrations. These often-overlooked flaws represent a fertile ground for local privilege escalation bugs. The same marshaling technique employed in this exploit, which targets missing DLLs, can also be used to crash or subvert flawed custom unmarshalers. Defenders are encouraged to proactively identify similar vulnerabilities by scanning in-process COM classes whose registered DLLs cannot be resolved on disk and then assessing whether an attacker could plant a malicious replacement.

What You Should Do

• Apply Updates Immediately: Administrators must deploy the August 2026 cumulative updates for Windows without delay. This patch specifically mitigates CVE-2026-66804.
• Review COM Hardening: Evaluate your environment for other privileged SYSTEM COM servers that may not have implemented the EOAC_NO_CUSTOM_MARSHAL flag or the COMGLB_UNMARSHALING_POLICY_STRONG setting.
• Proactive Scanning: Implement a strategy to scan for in-process COM classes where registered DLLs are unresolvable on disk. Investigate whether an attacker could plant a malicious DLL in such locations.
• Monitor for Exploitation: Remain vigilant for signs of local privilege escalation attempts on Windows systems, especially those that have not yet been patched.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.