Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)

Summary

Today we walk through Dark Elevator, a LPE in Windows 11. We reported it to Microsoft on May 20, 2026, and it is now fixed as CVE-2026-50343.A normal user can cause InstallService, the SYSTEM service behind the Windows app install pipeline, to load an attacker-controlled DLL into the SYSTEM svchost.exe process and obtain an interactive NT AUTHORITY\SYSTEM shell.The exploit chains two logic flaws: a writable plugin map in InstallService, and a Windows-shipped COM class whose backing DLL a normal user can plant. Because the exploit corrupts no kernel memory, it works deterministically every time. It also needs none of the usual preconditions: no administrator rights, no UAC consent, no reboot, and no service-control permissions over InstallService.The impact is high because code execution lands inside a Microsoft-signed SYSTEM service process. From that position an attacker can install services, create privileged accounts, tamper with protected machine-wide state, access other users' data, disable or bypass local security controls, and establish persistence with SYSTEM privileges.Tested target:Here is a demo of the exploit on Windows 11 25H2:The exploit takes three steps:Add a map entry that points a plugin at an existing COM class whose DLL sits under C:\ProgramData.Drop a malicious DLL at that path, a folder any normal user can write to.Ask InstallService to activate the plugin.InstallService then loads the attacker's DLL into its own SYSTEM process.The exploit chains two separate weaknesses:A writable plugin map. InstallService runs as SYSTEM and decides which COM class to load by reading StaticPluginMap, a registry key that any normal user can write. This lets an unprivileged user point the SYSTEM service at any CLSID.A user-plantable COM server. A COM class Windows ships, CrossDevice ({E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}), registers its in-process DLL at a path under %PROGRAMDATA% that any normal user can write, and the DLL need not already exist. This lets an ...