CVE-2026-85880: Microsoft Windows ALPC Heap Overflow Enables Local Privilege Escalation

Local privilege escalation flaws in core Windows IPC mechanisms remain a primary target for post-exploitation tradecraft. Tracked as CVE-2026-85880, a heap-based buffer overflow vulnerability in the Microsoft Windows Advanced Local Procedure Call (ALPC) subsystem allows an authenticated attacker with low privileges to execute code with elevated system rights.

Understanding the ALPC Heap Overflow (CVE-2026-85880)

ALPC serves as the underlying, high-performance inter-process communication facility for RPC infrastructure and subsystem messaging across the Windows kernel and user-mode services. The vulnerability combines a heap buffer overflow with uninitialized memory conditions (CWE-122, CWE-908) within ALPC message handling.

Because the flaw evaluates to a CVSS 7.8 rating under vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the conditions for exploitation are straight forward:

• Local Access (AV:L): The attacker must already possess execution capability on the target system.
• Low Complexity (AC:L): No specialized race conditions or complex environment state manipulation are needed.
• Low Privileges (PR:L): Standard user accounts or compromised low-privilege service accounts (such as IIS or network services) are sufficient.
• Zero User Interaction (UI:N): The exploit executes completely headlessly.

Once an attacker achieves arbitrary memory corruption inside an ALPC service host or kernel context, they can hijack control flow to elevate their context directly to NT AUTHORITY\SYSTEM.

Threat Landscape and Exploitation Risks

While public tracking has not confirmed active ransomware exploitation for this specific CVE yet, kernel and IPC-level privilege escalations in Windows are routinely incorporated into threat actor playbooks. Gaining SYSTEM rights is the standard prerequisite for dropping security agent drivers, disabling Endpoint Detection and Response (EDR) software, dumping local LSASS credentials, and establishing persistent administrative footholds.

Because the attack vector is local, the primary exposure point exists wherever unprivileged users, compromised service accounts, or web application shells can execute arbitrary binaries on host operating systems.

Remediation and Version Guidelines

Microsoft has released security updates addressing the flaw across affected desktop and server builds. Security teams should deploy the corresponding monthly updates immediately, verifying build revisions match or exceed the patched baselines:

• Windows 10 Version 22H2: Update to build 10.0.19045.7725 or later.
• Windows 10 Version 21H2: Update to build 10.0.19044.7725 or later.
• Windows 10 Version 1809 / Server 2019 baseline updates: Update to build 10.0.17763.9245 or later.
• Windows Server 2016 / Windows 10 Version 1607: Update to build 10.0.14393.9512 or later.
• Windows Server 2012 R2: Apply the September 2026 Security Only or Monthly Rollup patches.

Organizations aligned with CISA BOD 26-04 timelines must ensure affected endpoints and cloud-hosted instances are remediated by September 22, 2026. Where legacy systems cannot be patched immediately, host isolation and strict access restrictions on local interactive logins should be enforced.