# Proof-of-concept for CVE-2026-21508

**_For more information see:_** [https://0xc4r.github.io/posts/CVE-2026-21508](https://0xc4r.github.io/posts/CVE-2026-21508)


# Descrption:

Proof-of-concept consist in a simple batch script and a DLL project:
- The DLL will be used to perform the DLL hijacking attack and will mainly perform the following actions when loaded by `WUDFHost.exe`:
    1. Executes `RevertToSelf()` to stop impersonation and back to privileged status.
    2. Do something as an example. In this case, I launch an elevated instance of cmd.exe (on `session 0`) so that a successful run can easily be identified by checking with Process Explorer (or any other tool you prefer) if cmd.exe has been started by `WUDFHost.exe`
- the batch file `SETUP.bat` will just be used to copy the DLL to the correct folder and create the necessary registry keys to trigger `WUDFHost.exe` to load the crafted DLL.
- There is also a `.jpg` image in the POC that will be copied by `SETUP.bat` to the USB flash drive path you specify as the first argument, ensuring that at least one `.jpg` image is on the USB. 


# How to use:
As an unprivileged user, do:
1. Extract the POC into a folder of your choice.
2. Build the project as release
3. Ensure a USB flash drive is attached to the computer.
4. Launch `SETUP.bat` with first argument the USB flash drive path attached to the computer where `alps.jpg` will be copied e.g `SETUP.bat F:\` (ensuring that at least one `.jpg` image is on the USB. )
5. The vulnerability is triggered when `"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"` is started. So, if not already configured, configure Windows Media Player for the current user (you can use the default recommended settings). Note that this does not require admin privileges; Just follow the installer when `SETUP.bat` launches
`"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"`.

Note: proof‑of‑concept has been tested and developed for Windows 11.
#
Microsoft CVE-2026-21508: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21508](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21508)





