CVE-2026-66804 · Windows Cross Device Service Elevation of Privilege via Dangling COM…

01 · The Real Story

A ghost DLL in a public hallway that any visitor can swap for a master key

CVE-2026-66804 is a local privilege escalation in the Windows Cross Device Service — the background plumbing behind Phone Link, clipboard sync, and cross-device file sharing. The flaw is a dangling COM registration: the system-wide COM class {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} points its InProcServer32 at %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll, a path that does not exist on default installations. Because C:\ProgramData is writable by all authenticated users, any standard account can create the directory and drop a payload DLL. When the Windows Camera FrameServer service instantiates the COM object — trivially triggered via Media Foundation virtual-camera APIs — it loads the attacker's DLL as NT AUTHORITY\LOCAL SERVICE. From there, the token's enabled SeImpersonatePrivilege feeds a potato-class exploit (SigmaPotato or GodPotato variant) to obtain NT AUTHORITY\SYSTEM. This is a patch bypass for CVE-2026-50343 ('Dark Elevator'), where July 2026's fix closed the InstallService registry weakness but left this dangling COM registration untouched. Affected: Windows 10 22H2 (< build 19045.7663), Windows 11 24H2 (< 26100.9168), Windows 11 25H2 (< 26200.9168), Windows 11 26H1 (< 28000.2704).

Microsoft rates this Important / HIGH 7.8, and the score is honest. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H correctly captures the local-only attack vector, trivial complexity, and full SYSTEM impact. Two fully weaponized GitHub PoCs and a detailed Google Project Zero writeup have moved exploitation from theoretical to script-kiddie accessible. The vendor's temporal metrics still mark exploitability as 'Unproven' (E:U), which is now stale — functional exploit code is public. Despite that lag, the base score of 7.8 remains fair: the local-access prerequisite is a real gate and the blast radius is per-host, not fleet-scale.

"Trivial user-to-SYSTEM via phantom DLL — vendor HIGH is fair, patch your workstations"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Obtain standard-user code execution on target

The attacker needs an interactive or scripted shell as any standard (non-admin) user on the Windows host. This can come from phishing, compromised application, RDP with stolen credentials, or any other initial-access vector. No special group membership or privileges beyond a basic domain or local user account are required.

Conditions required:

Local or remote-to-local access as a low-privilege user on a Windows 10 22H2 or Windows 11 host

Where this breaks in practice:

Requires a prior initial-access step — the attacker must already be on the box
Organizations with strong email gateways, MFA on RDP, and endpoint hardening raise this bar significantly

Detection/coverage: EDR telemetry on new interactive/remote sessions; Windows Security Event 4624 Type 2/3/10

STEP 02

Verify dangling COM registration

The attacker queries the registry at HKLM\SOFTWARE\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}\InProcServer32 to confirm it points to %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll and that the directory does not exist. Both PoCs (DavidCarliez, Rat5ak) automate this check. On unpatched default installs, both conditions are met 100% of the time.

Conditions required:

COM class registered with InProcServer32 pointing to ProgramData (default on unpatched Win10 22H2/Win11)
C:\ProgramData\CrossDevice directory absent (default state)

Where this breaks in practice:

Virtually none — this is the default configuration on every affected OS version

Detection/coverage: Registry reads are benign OS operations; no practical detection at this step

STEP 03

Plant malicious DLL in ProgramData

The attacker creates C:\ProgramData\CrossDevice\ and drops a crafted CrossDevice.Streaming.Source.dll implementing the virtual-camera COM interface. The DLL's DllGetClassObject entry point contains the payload. This is a simple mkdir + file-copy operation requiring no elevation — ProgramData default ACLs grant Authenticated Users create-subfolder and write permissions.

Conditions required:

Write access to C:\ProgramData (default for all authenticated users)

Where this breaks in practice:

EDR products monitoring DLL creation in ProgramData subdirectories may flag this — CrowdStrike, SentinelOne, and Defender for Endpoint all have heuristics for suspicious DLL drops
WDAC or AppLocker in enforced mode blocking unsigned DLLs in ProgramData would stop this step cold

Detection/coverage: Sysmon Event ID 11 (FileCreate) for .dll in C:\ProgramData\CrossDevice\; EDR file-write telemetry; YARA rules on unsigned PE files in ProgramData

STEP 04

Trigger Camera FrameServer DLL load

The attacker invokes Media Foundation virtual-camera enumeration APIs (e.g., MFEnumDeviceSources with MF_DEVSOURCE_ATTRIBUTE_SOURCE_TYPE_VIDCAP_CATEGORY), which causes the Camera FrameServer service (svchost.exe -k FrameServerGroup) to instantiate the registered COM class. The service calls CoCreateInstance on the dangling CLSID, loading the attacker's DLL into a session-0 process running as NT AUTHORITY\LOCAL SERVICE. Both public PoCs bundle this trigger — DavidCarliez embeds VCamSample, Rat5ak uses a minimal MF API harness.

Conditions required:

Camera FrameServer service running (default on all affected SKUs)
Media Foundation APIs callable by standard users (default)

Where this breaks in practice:

Virtually none — the service is always running and the APIs are accessible to any user session

Detection/coverage: Sysmon Event ID 7 (ImageLoaded) for unsigned DLL loaded by svchost.exe in FrameServerGroup service group; process-tree anomalies in EDR — svchost loading a DLL from ProgramData is inherently suspicious

STEP 05

Escalate LOCAL SERVICE → SYSTEM via SeImpersonatePrivilege

The planted DLL now executes as NT AUTHORITY\LOCAL SERVICE with SeImpersonatePrivilege enabled. The payload uses a potato-class exploit — DavidCarliez embeds SigmaPotato 1.2.6, Rat5ak uses a GodPotato-derived OXID resolver + named-pipe impersonation chain — to capture a SYSTEM token and spawn an elevated process. The result is an interactive or non-interactive NT AUTHORITY\SYSTEM shell. The entire chain from user click to SYSTEM takes under 3 seconds.

Conditions required:

LOCAL SERVICE token with SeImpersonatePrivilege (always enabled for FrameServer)

Where this breaks in practice:

Potato-family exploits are well-studied by EDR vendors — CrowdStrike Falcon, SentinelOne, Microsoft Defender for Endpoint all have behavioral detections for OXID resolver abuse, named-pipe impersonation, and suspicious token manipulation
Windows Defender Credential Guard limits the value of SYSTEM on hardened hosts

Detection/coverage: EDR behavioral alerts for potato-style token impersonation; Sysmon Event ID 10 (ProcessAccess) with suspicious granted access masks; Windows Security Event 4624 Type 9 (NewCredentials) from LOCAL SERVICE to SYSTEM; named-pipe creation events

03 · Compensating Control

HIGH 7.8→LOW 2.5

SEVERITY REDUCED

Pre-create C:\ProgramData\CrossDevice with restrictive ACLs — Create the directory before an attacker does and set NTFS permissions to deny write access for standard users (only SYSTEM and Administrators should have modify rights). This breaks step 3 of the attack chain — the attacker cannot plant the malicious DLL. Deploy via GPO or SCCM within 30 days per the noisgate mitigation SLA for HIGH. Command:

mkdir C:\ProgramData\CrossDevice && icacls C:\ProgramData\CrossDevice /inheritance:r /grant:r SYSTEM:(OI)(CI)F /grant:r Administrators:(OI)(CI)F /grant:r "Authenticated Users":(OI)(CI)RX

HIGH 7.8→IGNORE 0.0

SEVERITY REDUCED

Remove the dangling COM registration — Delete the registry key HKLM\SOFTWARE\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} entirely. This eliminates the attack path at step 4 — FrameServer will never attempt to load the nonexistent DLL. Deploy within 30 days per the noisgate mitigation SLA. Caution: this may break Phone Link virtual camera features until the August patch is applied. Requires SYSTEM or admin privileges to modify HKLM.

HIGH 7.8→LOW 2.0

SEVERITY REDUCED

Enforce WDAC or AppLocker DLL rules blocking unsigned code in ProgramData — Configure a Windows Defender Application Control or AppLocker DLL rule in enforce mode that blocks execution of unsigned or non-Microsoft-signed DLLs from C:\ProgramData\*. This prevents step 4 even if the attacker plants the DLL. Apply within 30 days. Note: DLL enforcement in AppLocker requires Enterprise SKU and has a performance overhead; WDAC is preferred on modern Windows 11.

HIGH 7.8→MEDIUM 5.5

SEVERITY REDUCED

Deploy EDR detection for potato-class privilege escalation — Ensure your EDR platform has active behavioral detections for OXID resolver abuse, named-pipe token impersonation from service accounts, and suspicious SeImpersonatePrivilege usage by non-system services. CrowdStrike, SentinelOne, and Defender for Endpoint all ship rules for GodPotato/SigmaPotato patterns. This catches step 5 but does not prevent DLL loading — it is a detect-only control.

HIGH 7.8→IGNORE 0.0

SEVERITY REDUCED

Apply August 2026 cumulative update (definitive fix) — Roll out KB5120249 (Win10 22H2), KB5121003 or hotpatch KB5120994 (Win11 24H2/25H2), and KB5121000 (Win11 26H1). This is the vendor remediation that resolves the dangling COM registration. Target deployment within the 180-day noisgate remediation SLA for HIGH.

What doesn't work

UAC hardening — The exploit operates entirely within standard-user permissions for the DLL planting steps; no UAC prompt is involved. The privilege escalation occurs inside a system service, not via a UAC elevation request.
Network firewalls or segmentation — CVE-2026-66804 is a purely local privilege escalation with no network component. Blocking ports or isolating VLANs has zero effect on this attack path.
Disabling the Windows Camera app — The Camera FrameServer (svchost.exe -k FrameServerGroup) is a separate OS service from the Camera UWP app. Uninstalling the Camera app does not stop the FrameServer service from loading registered virtual-camera COM DLLs when triggered via Media Foundation APIs.
Credential Guard alone — While Credential Guard protects LSASS secrets, a SYSTEM shell can still tamper with EDR agents, install persistence, access local SAM hashes, read DPAPI blobs, and abuse machine account credentials for lateral movement.

04 · Intelligence Metadata

The supporting signals.

In-the-wild exploitation	No confirmed in-the-wild exploitation. Microsoft's advisory (Aug 11, 2026) states 'Exploitation Less Likely.' Not listed on CISA KEV. No campaigns attributed to this CVE by Mandiant, CrowdStrike, or Talos as of October 2026.
Proof of concept	Multiple functional public PoCs. DavidCarliez/CVE-2026-66804-CrossDevice-LPE — bundles SigmaPotato 1.2.6 and VCamSample; one-click user→SYSTEM. Rat5ak/CVE-2026-66804-CrossDevice-Service-EoP — GodPotato-derived chain, tested on Win11 26200.8524. Google Project Zero provided a detailed technical writeup with exploit methodology (Forshaw, Sep 2026).
EPSS	0.00298 (0.298%) — low exploitation probability in the next 30 days. Likely reflects the local-only vector and absence of in-the-wild activity. May lag behind PoC publication.
CISA KEV	Not listed. No known deadline or binding directive.
CVSS vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local attack vector (no remote), low complexity (deterministic), low privilege (standard user), no user interaction, unchanged scope, full CIA impact. Temporal: `E:U/RL:O/RC:C` per Microsoft (E:U is stale — PoCs are public).
Affected versions	Windows 10 22H2 (all editions), Windows 11 24H2 (x64/ARM64), Windows 11 25H2 (x64/ARM64), Windows 11 26H1 (x64/ARM64). Windows Server SKUs are not affected — Cross Device Service is a workstation feature.
Fixed versions	Win10 22H2: KB5120249 (build 19045.7663) · Win11 24H2: KB5121003 (build 26100.9168) or hotpatch KB5120994 · Win11 25H2: KB5121003 (build 26200.9168) or hotpatch KB5120994 · Win11 26H1: KB5121000 (build 28000.2704). All released August 11, 2026.
Internet exposure	Not applicable. This is a purely local privilege escalation — no network attack vector. GreyNoise, Shodan, and Censys scanning data are irrelevant. The threat is post-initial-access only.
Disclosure timeline	Original Dark Elevator (CVE-2026-50343) reported May 20, 2026, patched July 2026. Bypass (this CVE) reported by Daniel Wade (nadsec) as MSRC Case 119805 / VULN-192287. Microsoft advisory published August 11, 2026, updated August 14. Project Zero blog by James Forshaw published September 2026.
Researchers	Daniel Wade (nadsec) — original reporter of the dangling COM bypass via MSRC. James Forshaw (Google Project Zero) — variant analysis and custom COM marshaling technique. Calif.io — original Dark Elevator (CVE-2026-50343) research.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.8/10)

Why this verdict

Trivial, deterministic exploitation — Two fully weaponized PoCs on GitHub chain DLL planting → FrameServer COM load → SigmaPotato/GodPotato SYSTEM shell. No memory corruption, no race condition, works every time from a standard user account in under 3 seconds. The exploit complexity is *below* what AV:L/AC:L models — this is as easy as a local privesc gets.
Massive workstation attack surface — Affects every unpatched Windows 10 22H2 and Windows 11 machine. The C:\ProgramData\CrossDevice directory is absent by default, the dangling COM registration is present by default, and ProgramData grants Authenticated Users write access. Preconditions are met on effectively 100% of vulnerable hosts with no attacker effort.
Role multiplier: workstation-only, host-level blast radius — Cross Device Service is a consumer/workstation feature absent from all Windows Server SKUs. On workstations (≥95% of the affected installed base), SYSTEM compromise enables credential harvesting (Mimikatz, DPAPI), EDR agent tampering, and persistence — these are meaningful attack-chain enablers but the blast radius per-exploitation is *host-level*, not domain or fleet. Admin workstations and PAWs (<1% of fleet) are the highest-value role, where SYSTEM can pivot to domain admin — but additional steps and controls separate this CVE from that outcome. No canonically high-value infrastructure role is affected; the floor rule does not elevate above HIGH.

Why not higher?

This cannot be CRITICAL because exploitation requires the attacker to already have local code execution on the target workstation — a non-trivial prerequisite that implies a prior initial-access chain. The blast radius is confined to the individual host; there is no remote vector, no wormability, and no direct path to domain compromise. Windows Server SKUs, domain controllers, and all canonically high-value infrastructure roles are unaffected because the Cross Device Service is not present on server editions.

Why not lower?

Dropping to MEDIUM would undervalue the practical threat. The exploit is fully public, deterministic, requires zero user interaction, and achieves total host compromise (SYSTEM) from any standard user account. The affected population is enormous — every Windows 10/11 workstation. This is a textbook 'post-access force multiplier' that any red team or commodity malware author will integrate. Multiple working PoCs, a patch-bypass lineage, and trivial preconditions all argue against downgrading below HIGH.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows host from any user session (no elevation required). Save as Check-CVE202666804.ps1 and invoke: powershell -ExecutionPolicy Bypass -File .\Check-CVE202666804.ps1. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

#Requires -Version 5.1
# CVE-2026-66804 - Windows Cross Device Service LPE Vulnerability Check
# Run on target Windows host as any user. No elevation required.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$clsid    = '{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}'
$regKey   = "HKLM:\SOFTWARE\Classes\CLSID\$clsid\InProcServer32"
$plantDir = Join-Path $env:ProgramData 'CrossDevice'
$plantDll = Join-Path $plantDir 'CrossDevice.Streaming.Source.dll'

Write-Host '=== CVE-2026-66804 Vulnerability Check ==='

# --- OS info ---
$nv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$build = [int]$nv.CurrentBuildNumber
$ubr   = [int]$nv.UBR
$ver   = $nv.DisplayVersion
Write-Host "OS: Windows $ver  Build $build.$ubr"

# --- Patched-build lookup (August 2026 cumulative updates) ---
$minUBR = @{
    19045 = 7663   # Win10 22H2  KB5120249
    26100 = 9168   # Win11 24H2  KB5121003
    26200 = 9168   # Win11 25H2  KB5121003
    28000 = 2704   # Win11 26H1  KB5121000
}

if ($minUBR.ContainsKey($build) -and $ubr -ge $minUBR[$build]) {
    Write-Host "PATCHED - Build $build.$ubr includes the August 2026 fix."
    exit 0
}

# --- Check COM registration ---
if (-not (Test-Path $regKey)) {
    Write-Host "PATCHED - COM class $clsid InProcServer32 key not found."
    exit 0
}

$val = (Get-ItemProperty $regKey -Name '(Default)').'(Default)'
if ([string]::IsNullOrEmpty($val)) {
    Write-Host 'UNKNOWN - COM registration exists but default value is empty.'
    exit 2
}

$resolved = [Environment]::ExpandEnvironmentVariables($val)
if ($resolved -notlike '*ProgramData*CrossDevice*') {
    Write-Host 'PATCHED - InProcServer32 no longer points to writable ProgramData path.'
    Write-Host "  Current path: $resolved"
    exit 0
}

# --- Check for planted DLL (possible active exploitation) ---
if (Test-Path $plantDll) {
    $sig = Get-AuthenticodeSignature $plantDll
    if ($sig.Status -eq 'Valid' -and $sig.SignerCertificate.Subject -like '*Microsoft*') {
        Write-Host 'UNKNOWN - DLL present and Microsoft-signed. Manual review needed.'
        exit 2
    }
    Write-Host "VULNERABLE - ALERT: Non-Microsoft DLL found at $plantDll"
    Write-Host '  This may indicate active exploitation. Investigate immediately.'
    exit 1
}

# --- Vulnerable: dangling registration, no patch ---
Write-Host 'VULNERABLE - Dangling COM registration found:'
Write-Host "  CLSID: $clsid"
Write-Host "  Path:  $resolved"
Write-Host '  Directory absent. Any standard user can plant a payload for SYSTEM execution.'
exit 1