CVE-2026-66804: Cross Device Virtual Camera EoP

Independently discovered and reported the issue now tracked as CVE-2026-66804. MSRC confirmed the submission as a duplicate of an earlier report with the same underlying Windows Camera FrameServer root cause.

A standard Windows user can create a missing trusted path under C:\ProgramData\CrossDevice, plant the registered Cross Device virtual-camera COM DLL, and cause Windows Camera Frame Server to load attacker-controlled code as NT AUTHORITY\LOCAL SERVICE. The included proof chain uses the service token's enabled SeImpersonatePrivilege to obtain NT AUTHORITY\SYSTEM.

Primary fresh-VM missing-path to SYSTEM video

TL;DR

Windows registered the Cross Device virtual-camera COM server at:

%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll

On the fresh/default Windows 11 VM used for validation, the machine-wide registration existed before the backing directory did. A standard user created the missing directory, planted the expected DLL, and invoked the virtual-camera API. Camera Frame Server loaded the DLL as LOCAL SERVICE, after which the proof chain obtained a SYSTEM token and wrote a protected-path receipt.

This is a missing-path or pre-initialization issue. It is not a claim that a standard user can overwrite an existing, protected Microsoft DLL.

Vulnerability

The relevant machine-wide registration is:

HKLM\SOFTWARE\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}\InProcServer32
  (Default) REG_EXPAND_SZ %PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll

The demonstrated chain is:

1. A standard user confirms the machine-wide COM registration.
2. The user confirms that C:\ProgramData\CrossDevice is absent.
3. The user creates the missing directory and plants the registered DLL.
4. The user starts the Cross Device virtual camera through Media Foundation.
5. Windows Camera Frame Server loads the DLL as LOCAL SERVICE.
6. The DLL confirms that the service token has SeImpersonatePrivilege.
7. The adapted GodPotato-style proof chain obtains a SYSTEM token.
8. The PoC writes a protected-path receipt as NT AUTHORITY\SYSTEM.

Fresh VM Reproduction

Run this proof of concept only in a disposable, vulnerable lab VM that you own or are explicitly authorized to test. Snapshot the VM before use.

From a standard-user command prompt:

cd /d path\to\fresh-vm-repro
Run-CrossDevicePoC.cmd

The runner validates the expected registration and refuses to touch a pre-existing Cross Device directory or an unexpected helper binary. Successful execution produces LOCAL SERVICE, privilege, and SYSTEM receipts.

Full prerequisites, expected results, hashes, build commands, and cleanup steps are in fresh-vm-repro/README.md.

Video Evidence

Both recordings are retained because they document complementary parts of the case.

The captured fresh-VM console output is preserved in fresh-vm-transcript.txt.

Original Case Material

• Detailed analysis: docs/technical-report.md
• Missing-path clarification supplied to MSRC: docs/msrc-fresh-vm-clarification.md
• Original command notes and legacy compatibility wrappers: docs/archive/

Timeline

Third-Party Attribution

Portions of the OXID resolver, named-pipe impersonation, OBJREF construction, and SYSTEM-token acquisition logic were adapted and translated to C from GodPotato by BeichenDream and contributors.

See THIRD_PARTY_NOTICES.md and LICENSES/Apache-2.0.txt for attribution and license details.

Resources

• Microsoft advisory: CVE-2026-66804
• CVE record: CVE-2026-66804
• Reproduction package: fresh-vm-repro/
• Technical report: docs/technical-report.md

Disclaimer: This exploit code is provided for authorized security research and educational purposes only. Do not use it against systems you do not own or have explicit permission to test. Run it only in a disposable lab VM. The author is not responsible for misuse or damage.

CVE-2026-66804 - reported to MSRC as case 119805 / submission VULN-192287, with disposition Complete - Duplicate.

Microsoft acknowledgement: Daniel Wade with nadsec.

Daniel Wade - GitHub · Twitter/X · Bluesky · Mastodon · Medium · nadsec.online