Windows Media Player DLL Hijack -- Local Privilege Escalation (CVE-2026-21508)

CVE-2026-21508 is a DLL hijacking vulnerability that achieves Session 0 privilege escalation on Windows 11. WUDFHost.exe loads CrossDevice.Streaming.Source.dll from the user-writable path C:\ProgramData\CrossDevice\. By planting a malicious DLL and manipulating COM CLSID registry entries under HKCU, an unprivileged user redirects WUDFHost.exe to load the DLL in a privileged context when Windows Media Player triggers the driver framework. The DLL calls RevertToSelf() to drop impersonation and spawns an elevated cmd.exe.

Root Cause

WUDFHost.exe performs COM object instantiation via SHCoCreateInstance using CLSIDs that can be redirected through per-user HKCU registry entries. A low-privilege user can hijack the CLSID chain to force WUDFHost.exe to load an arbitrary DLL from a user-writable location. Adding a ShellFolder key bypasses verclsid.exe validation.

Attack Flow

1. DLL placement: Copy crafted DLL to C:\ProgramData\CrossDevice\CrossDevice.Streaming.Source.dll
2. COM hijack: Registry entries redirect CLSID {F5FB2C77-...} Instance to {E9F83CF2-...}
3. Validation bypass: ShellFolder key makes WUDFHost call CoCreateInstance directly
4. Trigger: Launch Windows Media Player with USB media present
5. Escalation: DLL calls RevertToSelf() and spawns elevated cmd.exe in Session 0

Impact

• Local privilege escalation on Windows 11
• Elevated command execution in Session 0
• Requires local user session and USB flash drive

Source files mirrored from 0xc4r/CVE-2026-21508_POC.

Key Files

Exploit Code (dllmain.cpp core)

1
2
3
4
5

BOOL myvar = RevertToSelf();  // drop impersonation
if (IsElevated()) {
    CreateProcessA(NULL, "C:\\Windows\\System32\\cmd.exe",
                   NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
}

Expected Outcome

After SETUP.bat and WMP activation, Process Explorer shows cmd.exe as child of WUDFHost.exe running at elevated integrity in Session 0.

• MSRC – CVE-2026-21508
• 0xc4r blog writeup
• 0xc4r/CVE-2026-21508_POC (upstream)

All source files screened. DLL project is a simple C++ DLL (47 lines) calling RevertToSelf() and CreateProcessA. SETUP.bat creates two registry keys. alps.jpg is a stock landscape photograph (3.3MB). No pre-compiled DLL binaries – must build from Visual Studio source. No obfuscation, no remote connections, no network activity. Tested for Windows 11.