Listen to this Post
CVE-2026-85880 is a heap-based buffer overflow in Windows ALPC.
ALPC is the Advanced Local Procedure Call mechanism in Windows.
ALPC supports local inter-process communication between user and privileged components.
The vulnerability is tracked as CWE-122 and CWE-908.
CWE-122 is heap-based buffer overflow.
CWE-908 is use of uninitialized resource.
Microsoft Corporation is the source for the CVE.
The NVD published the CVE on Sep 08, 2026.
The NVD last modified the CVE on Sep 09, 2026.
CISA added it to the Known Exploited Vulnerabilities Catalog.
CISA lists the vulnerability name as Microsoft Windows Heap-Based Buffer Overflow Vulnerability.
CISA added it on September 08, 2026.
CISA due date is September 22, 2026.
The description states an authorized attacker can elevate privileges locally.
The attack requires local access and authorized user context.
The vulnerable component handles ALPC messages.
A crafted ALPC message can trigger an out-of-bounds heap write.
The overflow may corrupt adjacent heap metadata or objects.
Uninitialized resource use may affect message state or pointer handling.
Memory corruption can lead to privilege escalation.
Successful exploitation may execute code in a higher-integrity context.
The impact is local elevation of privileges.
Affected Windows 10 versions include 1607, 1809, 21H2, and 22H2.
Affected Windows Server versions include 2012, 2012 R2, 2016, 2019, and 2022.
Fixed builds include 10.0.14393.9512 and 10.0.17763.9245.
Fixed builds include 10.0.19044.7725 and 10.0.19045.7725.
Fixed builds include 10.0.20348.5622.
Windows Server 2012 fixed build is 6.2.9200.26349.
Windows Server 2012 R2 fixed build is 6.3.9600.23397.
Vendor advisory and patch information are from Microsoft.
CISA requires applying mitigations per vendor instructions.
CISA BOD 26-04 prioritizes security updates based on risk.
CISA also references Forensics Triage Requirements.
The KEV catalog requires action by the due date.
This is a real CVE entry in the NVD and CISA KEV.
DailyCVE Form:
Platform: Windows ALPC
Version: Multiple Windows
Vulnerability: Heap Buffer Overflow
Severity: Not Listed
date: Sep 08 2026
Prediction: September 22, 2026
What Undercode Say:
Analytics:
CVE="CVE-2026-85880"
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${CVE}" | jq '.vulnerabilities[bash].cve | {id, published, lastModified, descriptions, weaknesses}'
curl -s "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" | jq --arg cve "${CVE}" '.vulnerabilities[] | select(.cveID==$cve)'
powershell -Command "Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber" reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
Exploit: (Educational Purposes!)
- Identify ALPC endpoint.
- Send crafted message.
- Trigger heap overflow.
- Corrupt adjacent heap.
- Elevate local privileges.
Protection: from this CVE
- Apply Microsoft patches.
- Meet fixed builds.
- Restrict local access.
- Monitor KEV.
- Follow BOD 26-04.
- Use least privilege.
Impact:
- Local privilege escalation.
- Heap buffer overflow.
- Uninitialized resource use.
- Known exploited.
- Windows 10/Server affected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
