CVE-2026-85880 Overview
CVE-2026-85880 is a heap-based buffer overflow [CWE-122] in the Windows Advanced Local Procedure Call (ALPC) subsystem. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. Microsoft has confirmed the vulnerability across a broad range of supported Windows versions, from Windows 10 1607 through Windows Server 2022. CISA has added CVE-2026-85880 to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed in-the-wild abuse.
Critical Impact
Successful exploitation grants SYSTEM-level privileges from a low-privileged local account, enabling full compromise of the affected host.
Affected Products
- Microsoft Windows 10 (1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
- Microsoft Windows Server 2012 and 2012 R2
- Microsoft Windows Server 2016, 2019, and 2022
Discovery Timeline
- 2026-09-08 - CVE-2026-85880 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
- 2026-09-10 - EPSS score published at 0.572% (percentile 45.4)
Technical Details for CVE-2026-85880
Vulnerability Analysis
The vulnerability resides in the Windows Advanced Local Procedure Call (ALPC) component, a kernel-mode inter-process communication mechanism used extensively by Windows services. ALPC brokers messages between clients and servers running at different privilege levels, making flaws in this subsystem attractive for privilege escalation. A heap-based buffer overflow [CWE-122] in ALPC message handling allows an authorized attacker to write beyond the bounds of an allocated kernel pool buffer.
Exploitation results in memory corruption within the kernel heap. Attackers can leverage this corruption to overwrite adjacent kernel structures, hijack control flow, or manipulate security tokens to obtain SYSTEM privileges.
Root Cause
The root cause is improper validation of the size or contents of an ALPC message before copying data into a fixed-size heap buffer. When the supplied message exceeds the expected boundary, the excess bytes overwrite adjacent kernel pool memory. Because the vulnerable code executes in kernel context, the resulting corruption is directly usable for local privilege escalation.
Attack Vector
The attack requires local access and low privileges (PR:L), with no user interaction. An attacker who has already obtained code execution on the host—through phishing, a malicious document, or another initial-access vector—can invoke crafted ALPC calls against a privileged service endpoint. The specifically crafted message triggers the overflow inside the kernel, allowing the attacker to escape sandboxes or escalate from a standard user account to SYSTEM.
No verified public exploit code is available at time of publication. Technical details are described in the Microsoft Security Update guidance and the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-85880
Indicators of Compromise
- Unexpected child processes of privileged services (for example, services.exe or lsass.exe) launched by low-privileged users.
- Anomalous ALPC port creation or connections originating from user-mode processes that do not normally interact with system services.
- Kernel crashes (bugchecks) referencing ALPC-related modules on hosts where crashes were not previously observed.
Detection Strategies
- Monitor for token manipulation and privilege changes where a process suddenly runs with NT AUTHORITY\SYSTEM context after starting as a standard user.
- Correlate Windows Event ID 4672 (special privileges assigned) with unusual parent processes or short-lived binaries.
- Baseline ALPC endpoint usage and alert on user-mode callers reaching sensitive service endpoints for the first time.
Monitoring Recommendations
- Ingest Windows Security, Sysmon, and kernel telemetry into a centralized analytics platform to correlate privilege escalation chains.
- Track patch compliance for the September 2026 Microsoft security updates across all Windows client and server assets.
- Prioritize monitoring on multi-user systems such as terminal servers, jump hosts, and VDI where local attackers are more likely to obtain footholds.
How to Mitigate CVE-2026-85880
Immediate Actions Required
- Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2026-85880 to all affected Windows versions.
- Prioritize patching of internet-facing servers, multi-user hosts, and endpoints belonging to privileged users given confirmed in-the-wild exploitation.
- Audit local accounts and remove unnecessary standard-user access to sensitive systems to reduce the attack surface for local escalation.
Patch Information
Microsoft released patches for all supported Windows versions listed in the advisory. Administrators should deploy the corresponding cumulative update for Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server 2012, 2012 R2, 2016, 2019, and 2022. Refer to the Microsoft Security Update Guide for KB article identifiers matching each build.
Workarounds
- No official workaround is documented by Microsoft. Patching is the only supported remediation.
- Reduce exposure by restricting interactive and remote logon rights on affected systems until updates are deployed.
- Enforce application allowlisting to limit the ability of unapproved binaries to invoke ALPC endpoints on unpatched hosts.
# Verify installed updates on a Windows host
wmic qfe list brief /format:table
# PowerShell alternative to list recent hotfixes
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
