HIGH Actively exploited CWE-122
CVE-2026-85880
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Microsoft·Windows
7.8/ 10
CVSS 3.1
High severity
0.39%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 33% of all CVEs
Listed
CISA KEV catalog
- Added
- Sep 8, 2026
- Fix due
- Sep 22, 2026
- Ransomware
- Not known
Timeline
- Published
- Sep 8, 2026
- Updated
- Oct 31, 2026
- First covered
- Sep 12, 2026
- Latest story
- 2 months ago
Summary
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
CWE-122Heap-based Buffer Overflow
Attack profile
Attack vectorLocal
ComplexityLow
PrivilegesLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:CCISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected products
- Microsoft Windows 10 Version 160710.0.14393.0 to before 10.0.14393.9512
- Microsoft Windows 10 Version 180910.0.17763.0 to before 10.0.17763.9245
- Microsoft Windows 10 Version 21H210.0.19044.0 to before 10.0.19044.7725
- Microsoft Windows 10 Version 22H210.0.19045.0 to before 10.0.19045.7725
- Microsoft Windows Server 20126.2.9200.0 to before 6.2.9200.26349
- Microsoft Windows Server 2012 (Server Core installation)6.2.9200.0 to before 6.2.9200.26349
- Microsoft Windows Server 2012 R26.3.9600.0 to before 6.3.9600.23398
- Microsoft Windows Server 2012 R2 (Server Core installation)6.3.9600.0 to before 6.3.9600.23398