Windows Storage Elevation of Privilege Vulnerability
CVE-2026-21508 is an elevation of privilege vulnerability in Windows Storage caused by improper authentication. The available supporting content indicates a logical flaw in windows.storage.dll that can be abused by a local authorized attacker by manipulating the current user’s registry entries and hijacking the CLSID parameter passed to CoCreateInstance when invoked by a higher-privileged process. This can result in unintended execution in a higher-privilege security context and privilege escalation on the local system.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository is a Windows local privilege-escalation proof-of-concept for CVE-2026-21508. It consists of (1) a batch setup script (SETUP.bat) that stages a malicious DLL and configures per-user COM registry keys under HKCU\Software\Classes\CLSID to influence WUDFHost.exe COM activation, and (2) a Visual Studio C++ DLL project (Session0_CMD) that implements the payload. Key behavior: - SETUP.bat copies a bundled JPG (alps.jpg) to a user-provided USB drive letter to satisfy a condition that at least one .jpg exists on the USB. - It creates C:\ProgramData\CrossDevice and copies the built DLL to C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll (the hijack target name). - It adds/creates specific HKCU CLSID keys to force WUDFHost.exe to instantiate a chosen CLSID and to alter activation flow (per comments: avoid verclsid.exe and call CoCreateInstance directly). - It triggers the vulnerable path by launching Windows Media Player (wmplayer.exe). Payload DLL (Session0_CMD/dllmain.cpp): - On DLL_PROCESS_ATTACH, calls RevertToSelf() to stop impersonation. - Checks token elevation via OpenProcessToken/GetTokenInformation(TokenElevation). - If elevated, spawns C:\Windows\System32\cmd.exe using CreateProcessA, demonstrating code execution in a privileged context (often visible as a WUDFHost.exe child, potentially in Session 0). Repo structure: - Root: README.md (usage steps and links), SETUP.bat (stager/trigger), LICENSE. - Session0_CMD/: Visual Studio solution/project files and minimal C++ source (dllmain.cpp plus precompiled header scaffolding). No network C2 or remote endpoints are present; all observables are local file paths and registry keys used to stage and trigger the hijack.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows Storage (windows.storage.dll) elevation of privilege vulnerability involving registry manipulation to hijack COM activation (CLSID/CoCreateInstance) when invoked by a high-privilege process.
An elevation of privilege vulnerability in Windows Storage.
An elevation of privilege vulnerability in Windows Storage (no additional details provided in the content).
An elevation of privilege vulnerability in Windows Storage.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.