🟢 CVE-2026-85880

CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) component that allows an authorized, low-privileged local attacker to elevate privileges to SYSTEM. The CVSS vector is AV:L (Local) with PR:L (low privileges required), confirming this cannot be triggered remotely over a network. Despite being actively exploited (CISA KEV listed), it is a local privilege escalation bug and does NOT qualify for T1190.

← Back to Overview
LOW_RISK
Risk Level
7.8
CVSS Score
LOCAL
Attack Vector
Privilege Escalation
ATT&CK Tactic
T1068 — Exploitation for Privilege Escalation
ATT&CK Technique
VERY_LOW
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-09-08

Added to CISA KEV: 2026-09-08 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-85880 is a high-severity heap-based buffer overflow vulnerability located within the Windows Advanced Local Procedure Call (ALPC) component. It affects Microsoft Windows operating systems and is significant because it allows an authorized, low-privilege attacker to elevate their access to System-level privileges. Due to its active exploitation in the wild as a zero-day, it has been included in the CISA Known Exploited Vulnerabilities (KEV) catalog, making immediate remediation critical for organizations using Windows systems [1][3].

Exploitation

  • Active Exploitation: The vulnerability is confirmed to be actively exploited in the wild as a zero-day [1].
  • Threat Actors: Specific threat actor groups or ransomware campaigns associated with this exploit have not been publicly disclosed in current advisories.
  • PoC/Exploit Availability: Public proof-of-concept or exploit code availability is currently limited; however, its status as a zero-day implies exploitation capability exists in the hands of sophisticated attackers.
  • Prerequisites:
- Access Level: Requires the attacker to already have an authorized, low-privilege local code execution foothold on the system [4]. - Network vs Local: This is a local exploit; it cannot be triggered remotely over a network [5]. - User Interaction: No specific user interaction is noted as a requirement beyond the initial code execution foothold.

Affected Products & Patches

  • Affected Products: Microsoft Windows operating systems utilizing the ALPC component [6].
  • Patch Availability: Microsoft released a security update to address this vulnerability on September 8, 2026, which is available via Windows Update or the Microsoft Update Catalog [2].
  • Mitigations: There are no widely recognized workarounds other than applying the official security patch and rebooting the affected systems to ensure the kernel-level changes take effect [2].

Impact

  • Exploitation Outcome: Successful exploitation grants the attacker System-level privileges, effectively bypassing standard Windows security restrictions [1].
  • Business Risk: For internet-facing deployments, this vulnerability is critical if an attacker gains initial entry (e.g., via a separate web-based vulnerability), as this flaw provides the necessary mechanism to move from a restricted account to full system control, facilitating further malicious activity such as data theft, installation of persistent backdoors, or ransomware deployment.

Sources

  1. Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited ...

    Microsoft on Tuesday rolled out a record number of patches, fixing 974 CVEs across its products, including two vulnerabilities exploited in the wild as zero-days. The first exploited zero-day, CVE-2026-85880, is a heap buffer overflow issue in the Windows Advanced Local Procedure Call (ALPC) that co…

  2. CVE-2026-85880 - Vulnerability Details - OpenCVE

    Download and install the Microsoft security update that addresses CVE‑2026‑85880 via Windows Update or the Microsoft Update Catalog. Reboot the affected systems after applying the update to ensure the kernel changes take effect. Monitor the Microsoft Security Response Center for additional advisorie…

  3. NVD-CVE-2026-85880 - NIST

    This CVE is in CISA's Known Exploited Vulnerabilities Catalog ; Microsoft Windows Heap-Based Buffer Overflow Vulnerability, September 08, 2026 ...

  4. CVE-2026-85880 & CVE-2026-81963 Windows Zero-Days

    CVE-2026-85880 is a heap-based buffer overflow vulnerability in Windows ALPC that can allow an attacker with low-privilege local code execution ...

  5. NVD-CVE-2026-85880

    CVE-2026-85880 Detail Description Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed