Google Project Zero has published an analysis of a recently patched Windows privilege escalation vulnerability, CVE-2026-66804. The researcher who reported it, along with 14 others, describes the issue as an incomplete fix for an earlier vulnerability, CVE-2026-50343, nicknamed "Dark Elevator" by a researcher named Calif.
The write-up focuses on the exploitation technique of dangling COM object registrations, which the post identifies as the root cause of the bug. This technique can be abused to escalate privileges on Windows, and the new case highlights how a previous patch failed to fully close the underlying problem.
Because this is a single source, there are no differing accounts to compare. The key takeaway is that even after Microsoft addressed "Dark Elevator," a related flaw remained, underscoring the difficulty of completely eliminating root causes in complex operating system components.