CVE-2026-85880

What is Windows ALPC?

Advanced Local Procedure Call (ALPC) is a core Windows inter-process communication mechanism. Many system services and sandboxed processes, including AppContainer apps and browser renderers, use ALPC to talk to more privileged components. Because it is the channel between low-privilege and high-privilege code, ALPC is a favored target for sandbox-escape and local-privilege-escalation chains; a memory-corruption bug in ALPC message handling can let sandboxed code reach out and corrupt a privileged process.

Overview

CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in Windows ALPC, rated CVSS 7.8. A local attacker, including code running inside a low-privilege AppContainer sandbox, can exploit it to elevate to SYSTEM. Microsoft confirmed active exploitation at the September 2026 Patch Tuesday, and CISA added the CVE to KEV the same day. It is the second of the two zero-days in that record-sized release.

Affected Versions

Apply the September 2026 cumulative update for your specific Windows or Windows Server version and edition; see the MSRC entry for the exact KB numbers.

Technical Details

A heap-based buffer overflow occurs when a routine writes more data into a heap allocation than it can hold. In ALPC, the flaw is triggered when the subsystem processes an invalid or oversized memory buffer in a message, overflowing a heap buffer and corrupting adjacent structures. An attacker who can run code in a low-privilege context, such as a compromised sandboxed process, can exploit the overflow to escape the sandbox and elevate to SYSTEM.

Attack characteristics:

• Authentication: local; the attacker needs low-privilege code execution, which a sandboxed process satisfies
• User interaction: none
• Vector: local (AV:L)
• Impact: elevation of privilege to SYSTEM (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Notably, the EPSS score for this CVE was reported below one percent despite confirmed exploitation, a reminder that statistical exploit-prediction scores lag real-world activity and should not override KEV status.

Discovery

Microsoft credited Volexity and Proofpoint. Both firms specialize in detecting targeted and nation-state activity, which suggests the discovery came from incident-response or threat-intelligence work rather than a routine bug-bounty submission, though Microsoft did not state this explicitly.

Exploitation Context

Microsoft marked the vulnerability as exploited at release. It is one of the two zero-days in the September 2026 Patch Tuesday, a release reported at roughly 964 to 974 CVEs with more than 100 rated critical. As an ALPC sandbox-escape and elevation bug credited to two targeted-threat firms, it fits the profile of the privileged second stage in an exploit chain. Microsoft did not disclose the threat actor, method, or scale, and no public proof of concept was reported.

Remediation

1. Apply the September 2026 cumulative update for the affected Windows and Windows Server version immediately. There is no configuration workaround.
2. Do not rely on EPSS to deprioritize this. The sub-one-percent EPSS coexists with confirmed exploitation and a CISA KEV listing; treat the KEV deadline as authoritative.
3. Hunt for sandbox-escape indicators: SYSTEM-level processes spawned from low-privilege AppContainer contexts, and unexpected privileged process creation following browser or document-handler activity.
4. Patch the companion zero-day CVE-2026-81963 (Windows Update stack link following) in the same cycle; both were exploited and both are fixed by the September cumulative updates.