Proof-of-concept for CVE-2026-21508

For more information see: https://0xc4r.github.io/posts/CVE-2026-21508

Descrption:

Proof-of-concept consist in a simple batch script and a DLL project:

• The DLL will be used to perform the DLL hijacking attack and will mainly perform the following actions when loaded by WUDFHost.exe:
  1. Executes RevertToSelf() to stop impersonation and back to privileged status.
  2. Do something as an example. In this case, I launch an elevated instance of cmd.exe (on session 0) so that a successful run can easily be identified by checking with Process Explorer (or any other tool you prefer) if cmd.exe has been started by WUDFHost.exe
• the batch file SETUP.bat will just be used to copy the DLL to the correct folder and create the necessary registry keys to trigger WUDFHost.exe to load the crafted DLL.
• There is also a .jpg image in the POC that will be copied by SETUP.bat to the USB flash drive path you specify as the first argument, ensuring that at least one .jpg image is on the USB.

How to use:

As an unprivileged user, do:

1. Extract the POC into a folder of your choice.
2. Build the project as release
3. Ensure a USB flash drive is attached to the computer.
4. Launch SETUP.bat with first argument the USB flash drive path attached to the computer where alps.jpg will be copied e.g SETUP.bat F:\ (ensuring that at least one .jpg image is on the USB. )
5. The vulnerability is triggered when "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" is started. So, if not already configured, configure Windows Media Player for the current user (you can use the default recommended settings). Note that this does not require admin privileges; Just follow the installer when SETUP.bat launches "C:\Program Files (x86)\Windows Media Player\wmplayer.exe".

Note: proof‑of‑concept has been tested and developed for Windows 11.

Microsoft CVE-2026-21508: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21508