PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2026-66804 PoC: Windows Cross Device virtual camera local privilege escalation to SYSTEM

github.com | vulnerability | High | CVE-2026-66804 | #public-poc | #privilege-escalation | #windows-security | #windows | #exploit | #dll-hijacking | #com-hijacking | #cwe-284 | #vulnerability | #cve | #poc | #cve-2026-66804 | #dll-planting
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A PoC for CVE-2026-66804: a missing-path DLL-planting flaw in Windows Cross Device virtual camera lets a standard user get code loaded as LOCAL SERVICE, then escalate to SYSTEM.

Why it matters

The PoC demonstrates a complete local privilege-escalation chain from a standard user to SYSTEM, and exploit code is now public. Affected Windows endpoints should install Microsoft's August 2026 security updates promptly. Reproduction plants a DLL in a system path and triggers a privileged service, so it should only be performed in an explicitly authorized, recoverable lab environment.
CVE
CVE-2026-66804
Vendor
Microsoft
Product
Windows Cross Device Service / Cross Device Virtual Camera
Affected versions
Windows 10 22H2 before 10.0.19045.7663; Windows 11 24H2 before 10.0.26100.9168; Windows 11 25H2 before 10.0.26200.9168; Windows 11 26H1 before 10.0.28000.2704
CVSS
7.8
Published
Collected

Related coverage

vulnerability · projectzero.google
[CVE-2026-66804] Windows Exploitation Techniques: Dangling COM Object Registrations
A Google Project Zero blog post examining a Windows privilege escalation technique involving dangling COM object registrations, which Microsoft addressed in a recent security update.
High · vulnerability · github.com
GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking
Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
High · vulnerability · github.com
CVE-2026-50656 PoC: Microsoft Defender RoguePlanet elevation-of-privilege patch bypass
The repository publishes a patch-bypass implementation for a Defender elevation-of-privilege flaw, increasing practical risk to affected endpoints. Administrators should update the Malware Protection Engine to a fixed version and validate the PoC only in an explicitly authorized isolated environment; public availability does not by itself confirm exploitation in the wild.
High · vulnerability · github.com
CVE-2026-42980 PoC: Windows kernel WMI integer underflow local privilege escalation
The public code turns a Windows kernel integer underflow into local escalation from a normal user to SYSTEM, making it relevant to authorized kernel research and patch validation. Reproduction should be limited to owned, isolated, recoverable systems, and Microsoft fixes should be applied promptly.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
tool · github.com
CVE-2026-26119 PoC: Windows Admin Center authenticated RCE
The PoC shows that a low-privileged valid account can turn the flaw into remote command execution over the network. Upgrade to Windows Admin Center 2.6.4 or later and review WAC accounts and anomalous PowerShell activity.
Back