Original research · CVE-2026-66804
A standard Windows user can create a missing trusted Cross Device path, plant the registered COM DLL, and reach SYSTEM through Windows Camera Frame Server.
NadSec Research
Standard-user to SYSTEM privilege escalation.
Bug class
Missing-path DLL planting
Machine-wide COM path
Impact
SYSTEM
Via LOCAL SERVICE
Required access
Standard user
No admin token
Microsoft score
7.8 High
CWE-284
All Blog Posts
NadSec original research
Primary fresh/default VM revalidation showing standard-user planting, LOCAL SERVICE execution, and SYSTEM receipts. The recording reviews the earlier missing-path state through terminal scrollback; the transcript preserves the explicit pre-creation output.
I independently discovered and reported the issue now tracked as
CVE-2026-66804. MSRC confirmed my submission as a duplicate of an earlier
report with the same underlying Windows Camera FrameServer root cause.
A standard Windows user can create a missing trusted path under
C:\ProgramData\CrossDevice, plant the registered Cross Device virtual-camera
COM DLL, and cause Windows Camera Frame Server to load attacker-controlled code
as NT AUTHORITY\LOCAL SERVICE. The included proof chain uses the service
token's enabled SeImpersonatePrivilege to obtain NT AUTHORITY\SYSTEM.
| CVE | CVE-2026-66804 |
| Microsoft title | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability |
| MSRC case | 119805 |
| MSRC submission | VULN-192287 |
| MSRC disposition | Complete - Duplicate |
| Microsoft acknowledgement | Daniel Wade with nadsec |
| Release date | 2026-08-11 |
| Microsoft severity | Important |
| Microsoft CVSS | 7.8 High - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Microsoft CWE | CWE-284: Improper Access Control |
| Bug class | Missing-path DLL planting / COM object hijacking |
| Component | Cross Device Virtual Camera / Windows Camera FrameServer |
| COM class | {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} |
| Primary tested build | Windows 11 Pro 25H2 build 26200.8524 |
| Impact | Local standard user to NT AUTHORITY\SYSTEM |
Windows registered the Cross Device virtual-camera COM server at:
%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll
On the fresh/default Windows 11 VM used for validation, the machine-wide registration existed before the backing directory did. A standard user created the missing directory, planted the expected DLL, and invoked the virtual-camera API. Camera Frame Server loaded the DLL as LOCAL SERVICE, after which the proof chain obtained a SYSTEM token and wrote a protected-path receipt.
This is a missing-path or pre-initialization issue. It is not a claim that a standard user can overwrite an existing, protected Microsoft DLL.
The relevant machine-wide registration is:
HKLM\SOFTWARE\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}\InProcServer32
(Default) REG_EXPAND_SZ %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll
The demonstrated chain is:
C:\ProgramData\CrossDevice is absent.SeImpersonatePrivilege.NT AUTHORITY\SYSTEM.Run this proof of concept only in a disposable, vulnerable lab VM that you own or are explicitly authorized to test. Snapshot the VM before use.
From a standard-user command prompt:
cd /d path\to\fresh-vm-repro
Run-CrossDevicePoC.cmd
The runner validates the expected registration and refuses to touch a pre-existing Cross Device directory or an unexpected helper binary. Successful execution produces LOCAL SERVICE, privilege, and SYSTEM receipts.
Full prerequisites, expected results, hashes, build commands, and cleanup steps
are in the
fresh-vm-repro README.
Both recordings are retained because they document complementary parts of the case.
| Video | Role |
|---|---|
| Fresh-VM missing-path to SYSTEM | Primary fresh/default VM revalidation showing standard-user planting, LOCAL SERVICE execution, and SYSTEM receipts. The recording reviews the earlier missing-path state through terminal scrollback; the transcript preserves the explicit pre-creation output. |
| Guided full-chain standard-user to SYSTEM | Supporting walkthrough from the original submission. Shows the exploitation and impersonation chain in greater detail. The payload is already present at the beginning, so this recording provides chain context rather than independent fresh-state proof. |
The captured fresh-VM console output is preserved in the
fresh-vm transcript.
| Date | Event |
|---|---|
| 2026-06-01 | Initial report submitted to MSRC as VULN-192287; MSRC case 119805 opened |
| 2026-06-04 | Missing-path/pre-initialization clarification and clean reproduction archive supplied |
| 2026-06-05 | MSRC acknowledged the clarification |
| 2026-07-27 | MSRC confirmed the behavior, then determined the submission duplicated an earlier issue with the same underlying Windows Camera FrameServer root cause; credit was planned and no bounty was awarded |
| 2026-08-11 | Microsoft published CVE-2026-66804 and released security updates |
| 2026-08-13 | The acknowledgement wording Daniel Wade with nadsec was confirmed |
Portions of the OXID resolver, named-pipe impersonation, OBJREF construction, and SYSTEM-token acquisition logic were adapted and translated to C from GodPotato by BeichenDream and contributors.
See the repository's
THIRD_PARTY_NOTICES.md
and
LICENSES/Apache-2.0.txt
for attribution and license details.
Disclaimer: This exploit code is provided for authorized security research and educational purposes only. Do not use it against systems you do not own or have explicit permission to test. Run it only in a disposable lab VM. The author is not responsible for misuse or damage.
CVE-2026-66804 - reported to MSRC as case 119805 / submission
VULN-192287, with disposition Complete - Duplicate.
Microsoft acknowledgement: Daniel Wade with nadsec.
Daniel Wade - GitHub · Twitter/X · Bluesky · Mastodon · Medium · nadsec.online