# DLL side-loading from writable directory

Signed binary or COM registration loading a library by name from a user-writable or app directory

_Area: Memory corruption and native code. Seen in 5 disclosed reports; latest 2026-09-21. Updated 2026-10-23._

## How it works
A trusted, signed executable or a system-wide COM registration resolves a library by bare name, and the loader searches directories the attacker can write to (the app's own folder, `C:\ProgramData`, `AppData`, `C:\Users\Public`). The assumption that breaks is that the directory holding the binary is trusted and that the named DLL will be the vendor's. If the expected DLL is missing, or the search order prefers the app directory, anyone who can write there supplies the code that runs with the host's privileges.

## Where it shows up
- In-process COM classes registered system-wide whose DLL path is missing or under a writable directory [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md)
- Signed EXEs that load a same-directory DLL by name (camera/audio utilities, vendor helpers) [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md)
- Office or other processes loading DLLs from `C:\Users\Public` or `AppData` with odd extensions like `.tmp` [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)
- Privileged COM servers that do not set `EOAC_NO_CUSTOM_MARSHAL` or `COMGLB_UN…` hardening [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md)
- Loader calls (`LoadLibraryA`) resolving names from user-writable paths [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)

## How to review
For each signed binary and each COM/service registration, check the exact property: every library it loads resolves to a path the attacker cannot write, or is loaded by absolute path with a verified signature. Concretely: enumerate registrations, confirm the referenced DLL exists and sits in a protected directory; confirm the loader uses safe search flags (no current-directory/app-dir preference) or full paths; confirm privileged COM servers enable custom-marshal blocking. A missing DLL under a writable path is unsafe by definition.

## Variants seen
- Dangling COM registration pointing at a nonexistent writable ProgramData DLL, chained to a privileged COM server via custom marshaling [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md)
- Phishing lure drops DLLs that side-load a legitimate app's same-directory library for an in-memory implant [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)
- Legitimate signed vendor EXE side-loading a malicious same-directory DLL for C2 after RDP access [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md)

## Impact and severity
High: code executes with the host's privileges, up to SYSTEM for the COM case [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md), and gives persistent in-memory implants or C2 in the others [E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md). Severity rises when the host is privileged, the path is world-writable, and the loader lacks search-order or marshaling hardening.

## Why fixes fail
Evidence shows the pattern recurring across unrelated vendors [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md)[E2](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md); fixing one binary leaves other same-directory loaders and stale registrations exploitable.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md
- E2: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-advanced-techniques-used-in-malaysian-focused-apt-campaign.md
- E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-muddywater-attack-chain.md