CVE-2026-50343: InstallService StaticPluginMap EoP (Standard User to SYSTEM)

I independently discovered and reported the vulnerability now tracked as CVE-2026-50343. MSRC confirmed my submission as a duplicate of an earlier report from another researcher. A standard interactive user can write attacker-controlled plugin state under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State. The Microsoft Store Install Service runs as NT AUTHORITY\SYSTEM, reads PlugInList and StaticPluginMap, and loads the mapped DLL after a public AppInstallManager.SearchForAllUpdatesAsync() trigger. The result is local standard-user to SYSTEM code execution.

📹 Interactive SYSTEM shell demo video

TL;DR

InstallService trusts plugin names and DLL paths from HKLM state that a standard interactive user can write. A low-privileged user creates a fresh plugin name, points it at an attacker-controlled DLL, and calls the Store install-control WinRT API. InstallService then loads that DLL inside C:\Windows\System32\svchost.exe as NT AUTHORITY\SYSTEM.

The stronger fresh-VM repro in this repo opens a visible SYSTEM cmd.exe in the active desktop session. In the attached video, desktop-ud6iv88\user1 starts as a standard user and the spawned shell reports:

nt authority\system S-1-5-18

Vulnerability

The vulnerable state lives under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\PlugInList
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\StaticPluginMap

On tested builds, a standard interactive user can create the missing subkeys or set values beneath them. InstallService later consumes those values as plugin configuration while running as SYSTEM.

The core exploit chain:

1. Standard user places an attacker-controlled DLL in a readable location.
2. Standard user writes PlugInList\<fresh plugin name> = 1.
3. Standard user writes StaticPluginMap\<fresh plugin name> = <attacker DLL>.
4. Standard user calls AppInstallManager.SearchForAllUpdatesAsync().
5. InstallService loads the attacker DLL as SYSTEM.
6. DLL code executes as NT AUTHORITY\SYSTEM.

Interactive SYSTEM Shell Repro

Use the stronger repro:

interactive-system-shell-repro/

From a standard-user PowerShell:

cd interactive-system-shell-repro
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Cleanup-InstallServiceInteractiveShell.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Run-InstallServiceInteractiveShell.ps1

When the SYSTEM shell opens:

whoami /user
whoami /priv

Each run writes evidence under:

C:\Users\Public\InstallServiceEopProof\<timestamp>

Original Minimal Repro

The original MSRC submission files are still present for reference:

Usage:

powershell.exe -ExecutionPolicy Bypass -File .\exploit.ps1 -PayloadDll "C:\Users\Public\isp_exploit.dll"
powershell.exe -ExecutionPolicy Bypass -File .\exploit.ps1 -Cleanup

Timeline

Resources

• Microsoft advisory: CVE-2026-50343
• Strong repro: interactive-system-shell-repro/
• Demo video: interactive-system-shell-repro/evidence/installservice-staticplugin.mp4
• Original PoC: exploit.ps1
• Original canary source: canary.c

Disclaimer: This exploit code is provided for security research and educational purposes. Do not use it against systems you do not own or have explicit authorization to test. The author is not responsible for misuse.

CVE-2026-50343 - independently reported to MSRC as case 120271 / VULN-192719 and confirmed as a duplicate of an earlier researcher submission.

Daniel Wade - GitHub · Twitter/X · Bluesky · Mastodon · Medium · nadsec.online