# Signed binary loads DLL from writable path Signed EXE or COM class resolving a library by bare name from a user-writable directory _Area: Memory corruption and native code. Seen in 2 disclosed reports; latest 2026-09-21. Updated 2026-11-07._ ## How it works A trusted, signed component asks the OS to load a library by name only, and the loader's search order resolves that name to a file an unprivileged user can write. The signature on the caller proves nothing about the callee: the loader trusts the name, not the path. Two shapes: (a) a system-wide in-process COM class whose `InProcServer32` points at a missing DLL under a writable directory, so the first user to plant a file there wins [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md); (b) a signed EXE importing a bare DLL name, where the application directory precedes System32, so a planted copy beside the EXE is loaded [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md). The broken assumption is "the library next to me (or at my registered path) is the one I shipped." ## Where it shows up - COM registrations (HKLM `Software\Classes\CLSID`) whose `InProcServer32` path is missing, or lies under `ProgramData`, `%TEMP%`, `AppData`, or any user-writable directory [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md) - Signed EXEs importing bare names (`mscoree.dll`, vendor DLLs) with no full path or manifest redirect [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md) - Sideload packages: legitimate signed host EXE shipped beside a same-named malicious DLL [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md) - Loader calls lacking `LOAD_LIBRARY_SEARCH_SYSTEM32`/`LOAD_LIBRARY_SEARCH_APPLICATION_DIR`, or `SetDllDirectory`/`AddDllDirectory` absent ## How to review The invariant: every library load by a privileged or signed component resolves to a path the loading user cannot modify. Check each import and each COM `InProcServer32`: is the resolved path absolute, under a protected directory, and does the file exist? For COM, confirm the registration is not dangling and the directory is not writable by non-admins. For EXEs, confirm imports use full paths or the process sets a safe search order before loading. A writable-path load only escalates when the loading component runs at higher privilege than the writer, so also check who the loader runs as. ## How finders spotted it - Noticed a system-wide COM class registered to a DLL path that was missing and under writable ProgramData; then recalled a prior custom-marshaling technique and hunted for a SYSTEM COM service allowing custom marshaling, scanning combase capability flags [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md) - Hunting rules flagged a system infrequently running a few admin commands from an unusual process (max 12/day); pivoting on footholds exposed COM handlers pointing at signed binaries in user AppData [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md) - Reverse engineered a sideloaded `mscoree.dll`: spotted a `CreateProcessW` call site lacking `CREATE_SUSPENDED`, then an indirect call via a resolved function pointer with magic-byte checks; cross-refs dead-ended in `.data`/`.rdata` until `.NET 7.0` strings and a `.managed` section revealed a NativeAOT payload [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md) ## Variants seen - Dangling COM registration to writable path, chained with custom OBJREF marshaling for SYSTEM [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md) - Per-user COM hijack under HKU CLSID with `DllSurrogate=0` and a bloated signed DLL [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md) - DLL sideloading via signed host EXE beside malicious same-named DLL [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md) ## Impact and severity Reached SYSTEM privilege escalation when chained with custom marshaling against an unprotected COM server [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md); gave four years of espionage persistence [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md); enabled infostealer execution with BYOVD driver and process hollowing for defense evasion [E3](https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md). Severity rises with the privilege of the loading component and whether a privileged COM server lacks marshaling mitigations [E1](https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md). ## Seen in real software Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix. - **Microsoft Windows** (COM class registration (CrossDevice CLSID {E9F83CF2-E0C0-4CA) (version not stated): Windows Exploitation Techniques: Dangling COM Object Registrations (CVE-2026-66804). Report: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md - **Microsoft Windows** (DLL search-order loader) (version not stated): From 88 lines to 1: Detecting DLL hijacking with Elastic Defend. Report: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Aprojectzero-google-2026-09-windows-dangling-com-html.md - E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders.md - E3: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-dll-search-order-hijacking-elastic-defend.md