Proof of concept for a CrossDevice/FrameServer LPE I reported to MSRC which received CVE-2026-66804. It affects Windows 10 and Windows 11.
Windows registers this machine-wide COM server:
HKLM\SOFTWARE\Classes\CLSID\{E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}\InprocServer32
%PROGRAMDATA%\CrossDevice\CrossDevice.Streaming.Source.dll
On the vulnerable installations tested, C:\ProgramData\CrossDevice was absent and a standard user could create it. Planting the registered DLL and starting a Media Foundation virtual camera caused FrameServer to load the DLL as NT AUTHORITY\LOCAL SERVICE in session 0.
The PoC then uses the LocalService token's SeImpersonatePrivilege through an embedded SigmaPotato helper to obtain SYSTEM and open an ordinary cmd.exe on the active desktop. SigmaPotato is the final generic conversion step; the Microsoft security-boundary failure demonstrated here is the preceding attacker-controlled DLL load in FrameServer.
The PoC was tested on Windows 11 builds 26200.8875 and 29617.1000.
The target directory must not already exist. From a normal, non-elevated Command Prompt, run:
CrossDeviceLPE.exeThat's it. Now you should have
nt authority\system
The executable embeds all runtime components; no companion files or command-line arguments are required.
The PoC embeds SigmaPotato 1.2.6 and a build of VCamSample. Their licenses are under third_party/.
The repository contains the launcher and payload sources plus the two pinned third-party binaries required for an offline build. On Linux, install the MinGW-w64 GCC toolchain and run:
./build.sh