Cve 2026 66804

Dangling COM Registrations: How a Missing DLL Became a Windows SYSTEM Exploit

Google Project Zero's James Forshaw detailed CVE-2026-66804, an incomplete fix for the 'Dark Elevator' bug. A COM class registered system-wide but pointing at a DLL that did not exist let any local user plant code and run it as SYSTEM.