Dark Elevator: Windows Install Service Local Privilege Escalation (CVE-2026-50343)

Today we walk through Dark Elevator, a LPE in Windows 11. We reported it to Microsoft on May 20, 2026, and it is now fixed as CVE-2026-50343.

A normal user can cause InstallService, the SYSTEM service behind the Windows app install pipeline, to load an attacker-controlled DLL into the SYSTEM svchost.exe process and obtain an interactive NT AUTHORITY\SYSTEM shell.

The exploit chains two logic flaws: a writable plugin map in InstallService, and a Windows-shipped COM class whose backing DLL a normal user can plant. Because the exploit corrupts no kernel memory, it works deterministically every time. It also needs none of the usual preconditions: no administrator rights, no UAC consent, no reboot, and no service-control permissions over InstallService.

The impact is high because code execution lands inside a Microsoft-signed SYSTEM service process. From that position an attacker can install services, create privileged accounts, tamper with protected machine-wide state, access other users' data, disable or bypass local security controls, and establish persistence with SYSTEM privileges.

Tested target:

Microsoft Windows 11
Build: 10.0.26200.8457

Here is a demo of the exploit on Windows 11 25H2:

The exploit takes three steps:

Add a map entry that points a plugin at an existing COM class whose DLL sits under C:\ProgramData.

Drop a malicious DLL at that path, a folder any normal user can write to.

Ask InstallService to activate the plugin.

InstallService then loads the attacker's DLL into its own SYSTEM process.

The Bugs

The exploit chains two separate weaknesses:

A writable plugin map. InstallService runs as SYSTEM and decides which COM class to load by reading StaticPluginMap, a registry key that any normal user can write. This lets an unprivileged user point the SYSTEM service at any CLSID.

A user-plantable COM server. A COM class Windows ships, CrossDevice ( {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496} ), registers its in-process DLL at a path under %PROGRAMDAT…