Exploiting .NET Managed DCOM

Summary: Project Zero's James Forshaw described a vulnerability class in .NET's COM interoperability layers that makes .NET DCOM across privilege boundaries inherently insecure, exploiting the IManagedObject interface's GetSerializedBuffer method to trigger arbitrary deserialization in a server process. He used the technique to exploit the .NET ClickOnce Deployment broker (CVE-2014-4073) and, on a new work laptop, a Dolby audio driver COM service written in .NET, gaining local system code execution in under 5 minutes (CVE-2017-7293).
What you should know: Microsoft fixed CVE-2014-4073 by rewriting the broker in native code rather than changing IManagedObject::GetSerializedBuffer, and left the APIs for registering DCOM objects in .NET in place - so the bug class persisted until Forshaw found a Dolby service on his own laptop and had SYSTEM in under 5 minutes.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026