A newly disclosed Windows privilege escalation flaw, tracked as CVE-2026-66804, enabled a low-privileged user to inject a malicious DLL and execute arbitrary code with full NT AUTHORITY\SYSTEM privileges, exploiting a lingering weakness in how Windows handles Component Object Model (COM) registrations. This bug, patched by Microsoft in its August Patch Tuesday, was reported alongside 14 others and turned out to be an incomplete fix for an earlier flaw known as “Dark Elevator”. The root of the problem lies in a dangling COM object registration for the Windows CrossDevice component, the service behind Phone Link, clipboard sync, and cross-device file sharing.

This was not the first time CrossDevice registration caused trouble.

With the SYSTEM server running, the exploit simply passes a fake marshaled object through the object’s sole ICreateObject interface, triggering unconditional unmarshaling and loading the malicious DLL into the SYSTEM process for full privilege escalation. A proof-of-concept exploit code has become publicly available, and at least one commercial exploitation module now automates the LOCAL SERVICE-to-SYSTEM chain, highlighting the practical risk to unpatched hosts. The same marshaling trick that exploits missing DLLs can also crash or subvert buggy custom unmarshalers, and defenders can proactively hunt for similar flaws by scanning in-process COM classes whose registered DLLs cannot be resolved on disk, then checking whether an attacker could plant one.