CVE-2026-66804
ZDI-26-617: Microsoft Windows MIDI Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
Published Sep 8, 2026
Research mention from Google Project Zero. This is not vendor confirmation or proof of exploitation. This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Sep 8, 2026 · Catalog
Detected
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.
Sources
- CVE.orgVulnerability recordCVE-2026-66804
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-66804
30-day exploitation probability 0.3%
first.org - Google Project ZeroThreat researchCVE-2026-66804
Research mention from Google Project Zero. Not confirmation of exploitation.
projectzero.google - Zero Day InitiativeCoordinated disclosureZDI-26-617
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-66804.
zerodayinitiative.com