CVE-2026-85880
Description
CVE-2026-85880 is a high-severity heap overflow in Windows ALPC allowing local privilege escalation. Actively exploited; update Windows systems immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| windows_10_1607 | * | 10.0.14393.9512 | vulnerable |
| windows_10_1607 | * | 10.0.14393.9512 | vulnerable |
| windows_10_1809 | * | 10.0.17763.9245 | vulnerable |
| windows_10_1809 | * | 10.0.17763.9245 | vulnerable |
| windows_10_21h2 | * | 10.0.19044.7725 | vulnerable |
| windows_10_21h2 | * | 10.0.19044.7725 | vulnerable |
| windows_10_21h2 | * | 10.0.19044.7725 | vulnerable |
| windows_10_22h2 | * | 10.0.19045.7725 | vulnerable |
| windows_10_22h2 | * | 10.0.19045.7725 | vulnerable |
| windows_10_22h2 | * | 10.0.19045.7725 | vulnerable |
| windows_server_2012 | - | - | vulnerable |
| windows_server_2012 | r2 | r2 | vulnerable |
| windows_server_2016 | * | 10.0.14393.9512 | vulnerable |
| windows_server_2019 | * | 10.0.17763.9245 | vulnerable |
| windows_server_2022 | * | 10.0.20348.5622 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Microsoft has released security updates to address this ALPC vulnerability. Immediately download and install the latest cumulative security updates from the Microsoft Security Response Center (MSRC) for all affected Windows versions.
Update affected systems
Ensure Windows 10 (1607, 1809, 21H2, 22H2) and Windows Server (2012, 2016, 2019, 2022) are updated beyond vulnerable builds, specifically targeting versions later than 10.0.19045.7725 for Windows 10 22H2 and 10.0.20348.5622 for Server 2022.
Restrict access
Because this vulnerability requires local access, enforce the principle of least privilege (PoLP). Audit and restrict interactive login permissions, ensuring only necessary personnel have local access to critical infrastructure and servers.
Monitor for exploitation
Utilize Endpoint Detection and Response (EDR) tools to monitor for unusual process spawning from system services or unexpected memory corruption events. Look for low-privileged accounts suddenly executing commands with SYSTEM-level permissions.
Detection Guidance
"Detection should focus on identifying anomalous behavior in the Windows ALPC subsystem. Monitor for unauthorized processes attempting to interact with system-level ALPC ports or unexpected crashes in the Local Security Authority Subsystem Service (LSASS). Security teams should also look for suspicious parent-child process relationships, such as a low-privileged user process spawning a shell with SYSTEM-level permissions, which is a common indicator of successful privilege escalation."