Windows InstallService Local Privilege Escalation via StaticPluginMap Registry Hijack

CVE-2026-50343, nicknamed Dark Elevator by its discoverer Calif.io, is a local privilege escalation in the Windows InstallService (InstallService). The service runs as NT AUTHORITY\SYSTEM inside svchost.exe and decides which fulfillment plugin DLL to load by reading a StaticPluginMap registry key under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State. That key ships with ACLs that let any standard interactive user create subkeys and write values. A second flaw compounds the first: a Windows-shipped CrossDevice COM class registers its InprocServer32 DLL at a path under %PROGRAMDATA% where unprivileged users can plant files. By writing a crafted registry value that points InstallService at the attacker-controlled COM class and then triggering AppInstallManager.SearchForAllUpdatesAsync(), a normal user gets the SYSTEM service to load their DLL — no memory corruption, no UAC prompt, no reboot. Every supported Windows desktop and server release is affected: Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019/2022/2025. The fix shipped in the July 2026 Patch Tuesday cumulative updates.

Microsoft rated this HIGH at CVSS 7.8, and that score is honest. The AV:L/PR:L requirements mean an attacker must already have a local shell as a standard user — this is post-initial-access, not an internet-facing entry point. However, the exploit is a pure logic bug with 100% reliability, a full public PoC with prebuilt binaries is available on GitHub, and the blast radius on high-value targets (domain controllers, AD CS servers, Hyper-V hosts) is domain-takeover-grade. The vendor severity accurately reflects the technical reality; the public weaponization makes urgency higher than EPSS alone would suggest.

Sources.

1. Microsoft Security Advisory
2. Calif.io - Dark Elevator Write-up
3. Calif.io GitHub PoC Repository
4. SecurityOnline - Public Exploit Code Released
5. Rapid7 Vulnerability Database
6. Qualys July 2026 Patch Tuesday Review
7. Check Point IPS Advisory CPAI-2026-8456
8. Rat5ak GitHub PoC

Run this script on each target Windows host with standard user privileges (no admin required for the registry ACL check; Get-HotFix may need admin). Invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-50343.ps1. Returns exit code 0 (PATCHED), 1 (VULNERABLE), or 2 (UNKNOWN).

#Requires -Version 5.1
<#
.SYNOPSIS
  CVE-2026-50343 (Dark Elevator) - Vulnerability Check
.DESCRIPTION
  Checks for July 2026 patch KBs and validates InstallService
  registry ACLs to determine if the host is vulnerable.
#>
[CmdletBinding()]
param()

$ErrorActionPreference = 'SilentlyContinue'
$fixKBs = @('KB5099536','KB5099538','KB5099539','KB5099540','KB5101649','KB5101650')
$regPath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State'

# --- Check 1: Patch KB installed? ---
try {
    $hotfixes = (Get-HotFix | Select-Object -ExpandProperty HotFixID) 2>$null
    $matched = $fixKBs | Where-Object { $hotfixes -contains $_ }
    if ($matched) {
        Write-Host "PATCHED - July 2026 fix KB detected: $($matched -join ', ')"
        exit 0
    }
} catch {
    # Get-HotFix may fail without admin; continue to registry check
}

# --- Check 2: Registry key ACL ---
if (Test-Path $regPath) {
    try {
        $acl = Get-Acl -Path $regPath
        $writableByUsers = $acl.Access | Where-Object {
            ($_.IdentityReference.Value -match '(?i)(BUILTIN\\Users|Everyone|Authenticated Users|INTERACTIVE)') -and
            ($_.AccessControlType -eq 'Allow') -and
            (($_.RegistryRights -band 2) -ne 0)  # SetValue = 2
        }
        if ($writableByUsers) {
            $identities = ($writableByUsers | ForEach-Object { $_.IdentityReference.Value }) -join ', '
            Write-Host "VULNERABLE - InstallService State key writable by: $identities. No July 2026 patch KB found."
            exit 1
        } else {
            Write-Host "PATCHED - InstallService State registry ACLs are restrictive (no standard-user write)."
            exit 0
        }
    } catch {
        Write-Host "UNKNOWN - Could not read ACL on $regPath : $_"
        exit 2
    }
} else {
    Write-Host "UNKNOWN - Registry path $regPath not found. InstallService may not be present."
    exit 2
}