Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
NVD: Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
warncomponent_extraction: Component 'Windows Advanced Local Procedure Call (ALPC) endpoint handling — heap buffer overflow in ALPC message processing within ntoskrnl.exe' matches or contains product name 'Windows' — no specific component identified
Hunting hypothesis agent
Hunt for abnormal ALPC message sends from low-privileged processes to kernel endpoints -- ETW ALPC provider events show oversized messages triggering heap overflow in ntoskrnl.exe for SYSTEM escalation.
Research details
ComponentWindows Advanced Local Procedure Call (ALPC) endpoint handling — heap buffer overflow in ALPC message processing within ntoskrnl.exe
PreconditionsThe attacker must have local low-privileged user access (no elevated privileges required) on the target system. The target must run a vulnerable version of Windows 10 (1607 and later) or Windows 11. The attacker sends crafted ALPC messages to a vulnerable ALPC endpoint, triggering a heap-based buffer overflow during message processing. No network access or user interaction is required. The ALPC mechanism is a core kernel IPC facility, so exploitation grants SYSTEM-level code execution. This is the second ALPC zero-day exploited in the wild since CVE-2023-21674 (January 2023) and the first ALPC Patch Tuesday entry in over three years. agent
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 7.0–8.9). The vulnerability involves a heap-based buffer overflow (CWE-122) combined with use of an uninitialized resource (CWE-908) in the ALPC subsystem. This is the second ALPC vulnerability exploited as a zero-day in the wild since January 2023. Sixteen ALPC vulnerabilities have been patched since 2022, but this is the first to appear in Patch Tuesday since April 2023 (CVE-2023-28252) and the second to be actively exploited. No public PoC is available as of September 8, 2026.
SummaryCVE-2026-85880 is a high-severity (CVSS 7.8) elevation of privilege vulnerability in the Windows Advanced Local Procedure Call (ALPC) subsystem affecting Windows 10 (1607+) and Windows 11. The flaw is a heap-based buffer overflow (CWE-122) combined with use of an uninitialized resource (CWE-908) in ALPC message handling within ntoskrnl.exe. A local low-privileged attacker can send crafted ALPC messages to trigger the overflow, achieving SYSTEM-level code execution without network access or user interaction. This is the second ALPC zero-day exploited in the wild since CVE-2023-21674 (January 2023) and the first ALPC Patch Tuesday entry in over three years. Microsoft released a fix in the September 2026 Patch Tuesday update.
Tia coverage
First reported2026-06-10
First exploit report2026-09-08
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.