CVE-2026-85880: Heap-Based Buffer Overflow in Windows Advanced Local Procedure Call Enables Local Privilege Escalation

Background

Advanced Local Procedure Call (ALPC) is a Windows inter-process communication mechanism used extensively by core operating system components and privileged services to exchange messages between processes running on the same host. Many SYSTEM-level services — including components involved in authentication, RPC servicing, and other privileged subsystems — communicate over ALPC, making it one of the more security-sensitive IPC layers in Windows.

CVE-2026-85880 is a heap-based buffer overflow in this subsystem that allows a local attacker to elevate privileges.

Technical Mechanism

This vulnerability is classified under two related weaknesses: CWE-122 (Heap-Based Buffer Overflow) and CWE-908 (Use of Uninitialized Resource).

The combination of these two CWEs suggests a message-handling routine within an ALPC server component that either:

• allocates a heap buffer whose size is derived from an attacker-influenced value (such as a length field within an ALPC message) without adequately validating that the subsequent data actually written stays within that allocated size, resulting in a heap-based out-of-bounds write once a maliciously sized message is processed; or
• makes use of a resource (a buffer, handle, or object reference) before it has been properly initialized, so that attacker-influenced message timing or content causes the routine to operate on stale or unexpected data, which can itself corrupt heap state when combined with the overflow condition.

Because ALPC is a local-only IPC mechanism (it is not reachable over the network), exploitation requires the attacker to already have local code execution — typically as a standard, non-administrative user. From that position, the attacker crafts an ALPC message targeting a privileged server component that runs as SYSTEM, deliberately shaping the message’s size/length fields or timing to trigger the overflow or uninitialized-resource condition in the server’s message-handling code. Because the server process operates with SYSTEM privileges, successful heap corruption inside that process’s address space — if leveraged to redirect control flow or corrupt sensitive in-memory structures — can escalate the attacker’s own influence over that process to SYSTEM-level code execution, which is the privilege escalation outcome described in the CISA KEV entry.

The exact ALPC server component affected (and therefore the specific message type or endpoint involved) is not named in the data available for this article; Microsoft’s advisory should be consulted for component-level specifics.

Real-World Exploitation Evidence

CVE-2026-85880 is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, added on September 8, 2026, confirming active exploitation in the wild.

The knownRansomwareCampaignUse field is recorded as “Unknown” — CISA has not confirmed ransomware use of this vulnerability. As with other local privilege-escalation bugs, this does not rule out use as a second-stage tool in broader intrusions, including ransomware deployments that have already achieved initial low-privileged access; it only reflects that no such use has been publicly confirmed at this time.

No specific threat actor, intrusion set, or named campaign has been publicly attributed to exploitation of this CVE based on the data available for this article.

Impact Assessment

A local privilege escalation to SYSTEM via heap corruption in a privileged IPC server is a severe outcome:

• Confidentiality impact: SYSTEM-level access exposes credentials, LSASS memory, and any data on the machine regardless of original access controls.
• Integrity impact: The attacker can disable security tooling, tamper with system files, and install persistence mechanisms that survive reboot.
• Availability impact: A SYSTEM-level attacker can disrupt or disable the host entirely; even unsuccessful exploitation attempts that merely trigger the overflow without achieving clean code execution can crash the affected privileged service or the system.

As with other local-only privilege escalation vulnerabilities, the real-world danger is primarily as a second stage: an attacker who has already obtained a low-privileged foothold through some other means (phishing payload execution, a compromised application, a malicious insider) uses this flaw to convert that limited foothold into full administrative control of the host.

Affected Versions

The KEV data provided does not include a specific build/version matrix. Microsoft’s own advisory is the authoritative source:

Remediation Steps

1. Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-85880 via Windows Update, WSUS, or enterprise patch management.

   # Check installed update history for the KB associated with this fix
   Get-HotFix | Where-Object { $_.HotFixID -eq "<KB-number-from-MSRC-advisory>" }

2. Prioritize endpoints with higher local-foothold risk — systems frequently exposed to untrusted code execution, multi-user workstations, and any host already flagged for suspicious low-privileged activity.

3. Reduce the population of accounts capable of local code execution where feasible (application allow-listing, restricted user environments) as a defense-in-depth measure, since this bug requires local code execution as a precondition.

4. Maintain up-to-date EDR coverage capable of detecting anomalous privileged-process crashes or behavior, which is often the first visible sign of exploitation attempts against this bug class.

Detection Guidance

• Crash telemetry: Windows Error Reporting (WER) crash dumps or event-log crash entries showing heap corruption or access violations in processes hosting ALPC server components (commonly lsass.exe, svchost.exe instances hosting privileged services, or rpcss-related processes) warrant investigation, especially if correlated with activity from a low-privileged user session.
• Unexpected service restarts: unexplained restarts of privileged services shortly after suspicious local process activity can indicate failed exploitation attempts.
• EDR heap-corruption signatures: many EDR products include generic heap-corruption/control-flow-integrity detections; ensure these are enabled and tuned for processes known to host ALPC servers.

Exact detection signatures specific to this CVE were not available in the source material for this article; defenders should consult Microsoft’s advisory and their EDR vendor for CVE-specific guidance as it becomes available.

Timeline

References

• Microsoft Security Response Center — CVE-2026-85880
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-85880