Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalation

Windows Advanced Local Procedure Call (ALPC) contains a heap-based buffer overflow that allows privilege escalation from within a low-privilege AppContainer. An attacker who has achieved code execution inside an AppContainer sandbox can trigger the overflow to escape the sandbox boundary and escalate privileges on the local system.

ALPC is Windows’ internal high-speed inter-process communication (IPC) mechanism. It handles message passing between kernel-mode components and user-space processes. Because ALPC messages cross privilege boundaries, vulnerabilities in its message-handling code can let a process operating at low privilege influence operations that run at a higher level.

AppContainer is the sandbox model used for Universal Windows Platform (UWP) applications and browser content processes, including Microsoft Edge. It restricts the contained process’s access to the file system, registry, network interfaces, and kernel objects. Escaping an AppContainer converts a sandboxed code execution primitive into a process running with the logged-in user’s rights, which an attacker can then combine with a further privilege escalation step to reach SYSTEM.

A heap buffer overflow occurs when a process writes past the end of an allocated heap buffer, overwriting adjacent memory. In this case, the overflow occurs in ALPC’s message-parsing code. A process inside an AppContainer can send a crafted ALPC message that overwrites adjacent heap structures, corrupting control data or object pointers in a way that gives the process elevated access to memory it should not reach.

Patched September 8, 2026 as part of Microsoft’s record September Patch Tuesday, which addressed 974 CVEs total. CISA added CVE-2026-85880 to its Known Exploited Vulnerabilities catalog the same day. Federal agencies must apply mitigations by September 22, 2026 per BOD 26-04.

CVE-2026-85880 and CVE-2026-81963, a Windows Update Stack link-following privilege escalation also patched September 8, share the same CVSS 7.8 severity rating and the same CISA KEV remediation deadline. Both require an existing foothold on the machine; neither is directly remotely exploitable on its own. CISA’s active-exploitation confirmation on both means they appear in real intrusion chains, typically as the privilege escalation step after initial access is established.

The flaw is not remotely exploitable on its own: local code execution is a required precondition. In active intrusions, that precondition is typically already met before privilege escalation is needed.

For full Microsoft Patch Tuesday context, see Microsoft Patches Record 974 Vulns, 2 Zero-Days.

September 8, 2026 CISA KEV Batch

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on September 8, 2026 in a single enforcement update. All four carry confirmed active-exploitation status. The two Windows CVEs share a September 22 remediation deadline; the other two carry a September 11 deadline:

• CVE-2026-75650: CVSS 10.0, Adobe Commerce and Magento Open Source template-engine injection, unauthenticated RCE, September 11 deadline
• CVE-2026-81963: CVSS 7.8, Windows Update Stack link-following privilege escalation, September 22 deadline
• CVE-2026-85880 (this entry): CVSS 7.8, Windows ALPC heap buffer overflow, AppContainer sandbox escape, September 22 deadline
• CVE-2026-86218: CVSS 10.0, N-able N-central pre-authentication RCE, September 11 deadline

CVE-2026-85880 and CVE-2026-81963 are often chained together in practice: CVE-2026-85880 breaks out of an AppContainer sandbox (for example, from a browser content process), and CVE-2026-81963 then escalates the escaped process to SYSTEM using the Windows Update Stack. Both are closed by the same September 8 cumulative update.

FAQ

Who is at risk from CVE-2026-85880?

Any system running a supported version of Windows is in scope. The ALPC vulnerability is present in the Windows kernel, not a specific application. The most direct risk is on systems where an attacker has already achieved code execution inside an AppContainer sandbox, which is the isolation model used for browser content processes (including Microsoft Edge) and Universal Windows Platform apps. In practice, this flaw becomes relevant as a follow-on step after an attacker already has a foothold in a sandboxed process.

How is CVE-2026-85880 different from CVE-2026-81963?

Both are Windows local privilege escalation vulnerabilities patched September 8, 2026, and both carry CVSS 7.8. They attack different components. CVE-2026-81963 targets the Windows Update Stack through a link-following flaw; CVE-2026-85880 targets ALPC through a heap buffer overflow. CVE-2026-85880 specifically allows sandbox escape from an AppContainer, making it particularly relevant to browser-based exploitation chains. Both are confirmed as actively exploited by CISA.

What is the fix and how do I apply it?

The fix is the September 8, 2026 cumulative Windows update, delivered through Windows Update. No separate patch package is required. On managed enterprise systems, confirm through your patch management platform that the September 8 KB article for your Windows release has been applied. On home systems, run Windows Update and install all available updates. The same update also addresses CVE-2026-81963 and dozens of other September 8 Patch Tuesday vulnerabilities.