Windows Bug Class: Accessing Trapped COM Objects with IDispatch
Summary: Google Project Zero's James Forshaw describes a Windows bug class in which COM objects reachable across process and security boundaries can be abused, citing CVE-2019-0555, where a malicious client queried the old IXMLDOMDocument interface to run an XSLT script and escape a sandbox, and CVE-2017-0211, where a Structured Storage object's IPropertyBag interface created an arbitrary COM object in the server. He shows that IDispatch's GetTypeInfo returns an ITypeInfo interface trapped in the server process, and that its remotable CreateInstance method can instantiate a CoClass from the type library, demonstrated by creating a StdFont object inside svchost.exe.
Bottom line: A single remotable method on a trapped interface is enough to create objects with the server's privileges, and Forshaw found five IDispatch-exposing service classes to test in one pass, with StdFont reachable through a referenced type library.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-0211CVE-2019-0555
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026