# Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)

Writable StaticPluginMap registry key plus a user-plantable COM DLL under ProgramData let a normal user load code into SYSTEM InstallService for LPE.

- Payout: Research
- Severity: high
- Program: Microsoft
- Write-up by: r0keb
- Disclosed: 2026-07-22
- CVE: CVE-2026-50343
- Write-up quality: 8/10
- Original: https://blog.calif.io/p/dark-elevator-windows-install-service
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-calif-io-p-dark-elevator-windows-install-service
- Tags: area:os domain:desktop impact:privesc impact:rce kind:research platform:research sev:high tech:windows technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows InstallService (svchost SYSTEM service) and COM plugin activation
**Root cause:** InstallService reads StaticPluginMap from a user-writable HKLM registry key to choose a CLSID, then CoCreateInstance loads it in-process as SYSTEM; a shipped CrossDevice COM class registers its InprocServer32 DLL under writable %PROGRAMDATA% and need not exist.
**Steps:**
1. Create a value under `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\StaticPluginMap` mapping a plugin id to CLSID `{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}`
2. Drop malicious DLL at `C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll`
3. Trigger InstallService to activate the plugin, causing `CoCreateInstance(clsid, NULL, CLSCTX_INPROC_SERVER, IID_IInstallServicePlugin)` to load the DLL into SYSTEM svchost
**How found:** Reverse engineering and live debugging of InstallService revealed the plugin activation call chain ending in CoCreateInstance with an attacker-chosen CLSID from StaticPluginMap; then hunting for a shipped COM class whose InprocServer32 path is user-writable and need not pre-exist.
**Exploitation:** Unprivileged user writes the plugin map and plants the DLL, then requests plugin activation; InstallService loads the attacker DLL into its SYSTEM process yielding an interactive NT AUTHORITY\SYSTEM shell. No admin, UAC, reboot, or service-control permissions needed.
**Escalation:** Chains two logic flaws (writable plugin map + user-plantable COM server) to reach SYSTEM code execution inside a Microsoft-signed service process.
**Insight:** When a privileged service resolves a COM CLSID from a config/registry value, check whether that value is user-writable AND whether any shipped CLSID's InprocServer32 points into a user-writable directory like %PROGRAMDATA% with a non-existent DLL — the combination turns a benign registration into SYSTEM code load.