CVE-2026-85880 – Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) allows an authorized local attacker to elevate privileges. An attacker who can execute code from a low-privilege AppContainer can exploit the vulnerability to escape the sandbox and obtain SYSTEM privileges without requiring user interaction.

CVSS Score: 7.8

SEVERITY: Important

THREAT: The vulnerability creates a serious local privilege-escalation threat because successful exploitation can give an attacker SYSTEM-level privileges. The risk is elevated significantly because Microsoft reports that exploitation has already been detected.

EXPLOITS: Microsoft reports that this vulnerability is actively exploited. It is not publicly disclosed according to the available data. The CVSS v3.1 metrics list exploit code maturity as Unproven, and the data does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC) and involves a heap-based buffer overflow together with use of an uninitialized resource. An attacker who already has low privileges and can execute code inside a low-privilege AppContainer can trigger the vulnerability locally. Successful exploitation can allow the attacker to escape the application sandbox and elevate privileges to SYSTEM. The attack has low complexity, requires low privileges, requires no user interaction, and can result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows ALPC. Specific affected Windows versions are not identified in the available data. Exploitation requires local code execution with low privileges, including the ability to run code in a low-privilege AppContainer. No user interaction is required.

BUSINESS IMPACT: Successful exploitation can give an attacker SYSTEM privileges, potentially allowing complete control of an affected Windows endpoint. An attacker could access sensitive information, alter system configuration, install additional malicious software, disable security controls, or use the compromised device to support broader attacks inside an organization. Because exploitation has already been detected, vulnerable systems represent an immediate avenue for attackers who have obtained an initial foothold.

WORKAROUND: No specific workaround or mitigation is identified in the available data. Microsoft lists an official fix as the remediation. Where immediate patching is not possible, organizations should restrict opportunities for untrusted local code execution and closely monitor affected Windows systems for suspicious privilege-escalation activity.

URGENCY: Deployment should be prioritized because Microsoft reports active exploitation of this vulnerability. Although the severity is rated Important rather than Critical, successful exploitation can elevate an attacker from a low-privilege AppContainer to SYSTEM without user interaction. Systems where attackers may already have limited local access face particularly high risk.