CVE Details

CVE-2026-85880 Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Published: 2026-09-08 CVSS: 7.8 HIGH Product: Microsoft Windows Due Date: 2026-09-22

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

No GitHub PoC data.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

No EPSS data.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 7.8
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-85880
cveMetadata > assignerOrgId f38d906d-7342-40ea-92c1-6c4a2c6478c8
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName microsoft
cveMetadata > dateReserved 2026-09-04T18:18:19.326Z
cveMetadata > datePublished 2026-09-08T17:14:21.465Z
cveMetadata > dateUpdated 2026-09-08T18:48:22.100Z
containers > cna > title Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
containers > cna > datePublic 2026-09-08T14:00:00.000Z
containers > cna > cpeApplicability > 0 > nodes > 0 > operator OR
containers > cna > cpeApplicability > 0 > nodes > 0 > negate False
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding 10.0.17763.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding 10.0.17763.9245
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding 10.0.17763.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding 10.0.17763.9245
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding 10.0.17763.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding 10.0.17763.9245
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > criteria cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionStartIncluding 10.0.20348.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionEndExcluding 10.0.20348.5622
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > criteria cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionStartIncluding 10.0.19044.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionEndExcluding 10.0.19044.7725
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > criteria cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionStartIncluding 10.0.19045.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionEndExcluding 10.0.19045.7725
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > criteria cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionStartIncluding 10.0.14393.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionEndExcluding 10.0.14393.9512
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > criteria cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > versionStartIncluding 10.0.14393.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 7 > versionEndExcluding 10.0.14393.9512
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > criteria cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > versionStartIncluding 10.0.14393.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 8 > versionEndExcluding 10.0.14393.9512
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > criteria cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > versionStartIncluding 6.2.9200.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 9 > versionEndExcluding 6.2.9200.26349
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > criteria cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > versionStartIncluding 6.2.9200.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 10 > versionEndExcluding 6.2.9200.26349
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 11 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 11 > criteria cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 11 > versionStartIncluding 6.3.9600.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 11 > versionEndExcluding 6.3.9600.23397
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 12 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 12 > criteria cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 12 > versionStartIncluding 6.3.9600.0
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 12 > versionEndExcluding 6.3.9600.23397
containers > cna > affected > 0 > vendor Microsoft
containers > cna > affected > 0 > product Windows 10 Version 1607
containers > cna > affected > 0 > platforms > 0 32-bit Systems
containers > cna > affected > 0 > platforms > 1 x64-based Systems
containers > cna > affected > 0 > versions > 0 > version 10.0.14393.0
containers > cna > affected > 0 > versions > 0 > lessThan 10.0.14393.9512
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 1 > vendor Microsoft
containers > cna > affected > 1 > product Windows 10 Version 1809
containers > cna > affected > 1 > platforms > 0 32-bit Systems
containers > cna > affected > 1 > platforms > 1 x64-based Systems
containers > cna > affected > 1 > versions > 0 > version 10.0.17763.0
containers > cna > affected > 1 > versions > 0 > lessThan 10.0.17763.9245
containers > cna > affected > 1 > versions > 0 > versionType custom
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 2 > vendor Microsoft
containers > cna > affected > 2 > product Windows 10 Version 21H2
containers > cna > affected > 2 > platforms > 0 32-bit Systems
containers > cna > affected > 2 > platforms > 1 ARM64-based Systems
containers > cna > affected > 2 > platforms > 2 x64-based Systems
containers > cna > affected > 2 > versions > 0 > version 10.0.19044.0
containers > cna > affected > 2 > versions > 0 > lessThan 10.0.19044.7725
containers > cna > affected > 2 > versions > 0 > versionType custom
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 3 > vendor Microsoft
containers > cna > affected > 3 > product Windows 10 Version 22H2
containers > cna > affected > 3 > platforms > 0 32-bit Systems
containers > cna > affected > 3 > platforms > 1 ARM64-based Systems
containers > cna > affected > 3 > platforms > 2 x64-based Systems
containers > cna > affected > 3 > versions > 0 > version 10.0.19045.0
containers > cna > affected > 3 > versions > 0 > lessThan 10.0.19045.7725
containers > cna > affected > 3 > versions > 0 > versionType custom
containers > cna > affected > 3 > versions > 0 > status affected
containers > cna > affected > 4 > vendor Microsoft
containers > cna > affected > 4 > product Windows Server 2012
containers > cna > affected > 4 > platforms > 0 x64-based Systems
containers > cna > affected > 4 > versions > 0 > version 6.2.9200.0
containers > cna > affected > 4 > versions > 0 > lessThan 6.2.9200.26349
containers > cna > affected > 4 > versions > 0 > versionType custom
containers > cna > affected > 4 > versions > 0 > status affected
containers > cna > affected > 5 > vendor Microsoft
containers > cna > affected > 5 > product Windows Server 2012 (Server Core installation)
containers > cna > affected > 5 > platforms > 0 x64-based Systems
containers > cna > affected > 5 > versions > 0 > version 6.2.9200.0
containers > cna > affected > 5 > versions > 0 > lessThan 6.2.9200.26349
containers > cna > affected > 5 > versions > 0 > versionType custom
containers > cna > affected > 5 > versions > 0 > status affected
containers > cna > affected > 6 > vendor Microsoft
containers > cna > affected > 6 > product Windows Server 2012 R2
containers > cna > affected > 6 > platforms > 0 x64-based Systems
containers > cna > affected > 6 > versions > 0 > version 6.3.9600.0
containers > cna > affected > 6 > versions > 0 > lessThan 6.3.9600.23397
containers > cna > affected > 6 > versions > 0 > versionType custom
containers > cna > affected > 6 > versions > 0 > status affected
containers > cna > affected > 7 > vendor Microsoft
containers > cna > affected > 7 > product Windows Server 2012 R2 (Server Core installation)
containers > cna > affected > 7 > platforms > 0 x64-based Systems
containers > cna > affected > 7 > versions > 0 > version 6.3.9600.0
containers > cna > affected > 7 > versions > 0 > lessThan 6.3.9600.23397
containers > cna > affected > 7 > versions > 0 > versionType custom
containers > cna > affected > 7 > versions > 0 > status affected
containers > cna > affected > 8 > vendor Microsoft
containers > cna > affected > 8 > product Windows Server 2016
containers > cna > affected > 8 > platforms > 0 x64-based Systems
containers > cna > affected > 8 > versions > 0 > version 10.0.14393.0
containers > cna > affected > 8 > versions > 0 > lessThan 10.0.14393.9512
containers > cna > affected > 8 > versions > 0 > versionType custom
containers > cna > affected > 8 > versions > 0 > status affected
containers > cna > affected > 9 > vendor Microsoft
containers > cna > affected > 9 > product Windows Server 2016 (Server Core installation)
containers > cna > affected > 9 > platforms > 0 x64-based Systems
containers > cna > affected > 9 > versions > 0 > version 10.0.14393.0
containers > cna > affected > 9 > versions > 0 > lessThan 10.0.14393.9512
containers > cna > affected > 9 > versions > 0 > versionType custom
containers > cna > affected > 9 > versions > 0 > status affected
containers > cna > affected > 10 > vendor Microsoft
containers > cna > affected > 10 > product Windows Server 2019
containers > cna > affected > 10 > platforms > 0 x64-based Systems
containers > cna > affected > 10 > versions > 0 > version 10.0.17763.0
containers > cna > affected > 10 > versions > 0 > lessThan 10.0.17763.9245
containers > cna > affected > 10 > versions > 0 > versionType custom
containers > cna > affected > 10 > versions > 0 > status affected
containers > cna > affected > 11 > vendor Microsoft
containers > cna > affected > 11 > product Windows Server 2019 (Server Core installation)
containers > cna > affected > 11 > platforms > 0 x64-based Systems
containers > cna > affected > 11 > versions > 0 > version 10.0.17763.0
containers > cna > affected > 11 > versions > 0 > lessThan 10.0.17763.9245
containers > cna > affected > 11 > versions > 0 > versionType custom
containers > cna > affected > 11 > versions > 0 > status affected
containers > cna > affected > 12 > vendor Microsoft
containers > cna > affected > 12 > product Windows Server 2022
containers > cna > affected > 12 > platforms > 0 x64-based Systems
containers > cna > affected > 12 > versions > 0 > version 10.0.20348.0
containers > cna > affected > 12 > versions > 0 > lessThan 10.0.20348.5622
containers > cna > affected > 12 > versions > 0 > versionType custom
containers > cna > affected > 12 > versions > 0 > status affected
containers > cna > descriptions > 0 > value Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
containers > cna > descriptions > 0 > lang en-US
containers > cna > problemTypes > 0 > descriptions > 0 > description CWE-122: Heap-based Buffer Overflow
containers > cna > problemTypes > 0 > descriptions > 0 > lang en-US
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-122
containers > cna > problemTypes > 0 > descriptions > 1 > description CWE-908: Use of Uninitialized Resource
containers > cna > problemTypes > 0 > descriptions > 1 > lang en-US
containers > cna > problemTypes > 0 > descriptions > 1 > type CWE
containers > cna > problemTypes > 0 > descriptions > 1 > cweId CWE-908
containers > cna > providerMetadata > orgId f38d906d-7342-40ea-92c1-6c4a2c6478c8
containers > cna > providerMetadata > shortName microsoft
containers > cna > providerMetadata > dateUpdated 2026-09-08T18:34:29.412Z
containers > cna > references > 0 > name Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 0 > tags > 1 patch
containers > cna > references > 0 > url https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85880
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en-US
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > cvssV3_1 > baseScore 7.8
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-85880
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-08T18:44:18.362923Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85880
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-08T18:48:22.100Z