Windows Advanced Local Procedure Call

CVE-2026-85880 is a heap-based buffer overflow (CWE-122) in the Windows Advanced Local Procedure Call (ALPC) subsystem — the IPC mechanism that nearly every Windows service uses to talk to every other Windows service. A local attacker with low-privilege access sends a crafted ALPC message that overflows a heap buffer, corrupts adjacent memory, and escalates to SYSTEM. Affected builds span Windows 10 (builds 14393.x, 17763.x, 19044.x and later) and Windows 11 (24H2/25H2), meaning virtually the entire supported Windows fleet is vulnerable. Microsoft shipped the fix in the September 2026 Patch Tuesday cycle via KB5122876 and related KBs.

Microsoft rated this Important / HIGH 7.8, which undersells the real-world risk. The vendor score correctly reflects the local attack vector and low-privilege prerequisite, but it does not account for two decisive facts: (1) Microsoft itself confirms active exploitation in the wild — this is a zero-day, not a theoretical bug — and (2) ALPC is present on every Windows installation, including domain controllers and Hyper-V hosts, where SYSTEM-level compromise translates directly to domain takeover or hypervisor escape. A 7.8 might be fair for a theoretical local EoP; it is not fair for one that threat actors are already weaponizing against your fleet.

Why this verdict

• Active zero-day exploitation overrides theoretical friction. The local-access prerequisite is the primary downward pressure in the vendor score, but Microsoft confirms attackers are already landing this chain in the wild. Theoretical friction is irrelevant when exploitation is empirically proven.
• Universal attack surface with no version narrowing. ALPC is a core Windows IPC mechanism compiled into every supported Windows version from Server 2016 through Windows 11 25H2. There is no 'we don't run that component' escape hatch — if you run Windows, you're affected.
• Role multiplier: domain controllers and Hyper-V hosts. ALPC runs on domain controllers (≈2-5% of enterprise Windows fleet) and Hyper-V hosts (≈5-15%). On a DC, SYSTEM access grants direct ntds.dit access and DCSync capability — chain ends in domain takeover. On Hyper-V, SYSTEM accesses the hypervisor management plane — chain ends in fleet compromise. Both roles represent well above the 1% threshold. Because the bug is in a universal OS component (not role-defining software), the floor is HIGH per the ≥1% high-value-role rule; active exploitation pushes above the floor to CRITICAL.
• CWE-122 heap overflow in kernel-adjacent IPC. This is not a logic bug with narrow trigger conditions — heap overflows in IPC subsystems are a well-understood exploitation primitive with decades of tooling (heap spray, grooming). The related CVE-2026-20817 ALPC EoP already has a public exploit demonstrating the pattern.
• E:U temporal modifier is stale. The CVSS vector includes E:U (Unproven exploitability) which directly contradicts Microsoft's own active-exploitation tag. Correcting to E:H would raise the temporal score significantly.

Why not higher?

The score is already at the CRITICAL threshold. A 10.0 would require unauthenticated remote exploitation with no user interaction (wormable). This vulnerability requires local access and low-privilege authentication, which limits it from reaching the theoretical maximum.

Why not lower?

Downgrading below CRITICAL would require ignoring the confirmed active exploitation — the single strongest signal in vulnerability intelligence. The local-access prerequisite does create friction, but that friction is empirically defeated by real-world threat actors today. Additionally, the blast radius on domain controllers (domain takeover) and Hyper-V hosts (fleet compromise) sets a HIGH floor that cannot be broken without evidence that <1% of the installed base occupies these roles, which is demonstrably false for Windows.

1. Deploy September 2026 cumulative updates immediately — KB5122876, KB5122878, and KB5124008 are the definitive fix. Given active exploitation and noisgate CRITICAL verdict, deploy within 3 days (noisgate mitigation SLA). Prioritize domain controllers, Hyper-V hosts, and Tier 0 assets in the first 24 hours.
2. Enable LSASS RunAsPPL and Credential Guard on all servers — Even if the attacker achieves SYSTEM, Protected Process Light on LSASS and Credential Guard prevent trivial credential dumping, breaking the post-exploitation chain. Deploy within 3 days on Tier 0 assets.
3. Enforce least-privilege and remove local interactive logon rights — The attack requires low-privilege local code execution. Restricting interactive logon and removing unnecessary local accounts reduces the pool of hosts where an attacker can land the prerequisite. Audit via GPO Allow log on locally settings.
4. Enable ALPC-aware EDR detections — Ensure your EDR is updated with September 2026 signatures. CrowdStrike, SentinelOne, and Defender for Endpoint have released behavioral detections for ALPC-based EoP patterns. Validate detection fires in your environment.
5. Segment domain controllers and Tier 0 assets — Restrict which hosts can communicate with DCs to only authorized management workstations and member servers. This limits the attacker's ability to reach the highest-value targets even after local compromise of a workstation.

Run this on each target Windows host with local administrator privileges. Example: powershell -ExecutionPolicy Bypass -File Check-CVE202685880.ps1. The script checks the installed cumulative update against the patched build numbers for September 2026.

#Requires -RunAsAdministrator
# Check-CVE202685880.ps1
# Checks whether the September 2026 cumulative update addressing CVE-2026-85880 is installed.
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [System.Environment]::OSVersion.Version
    $currentBuild = $build.Build
    $currentRevision = $build.Revision
    # Also check via UBR registry key for accuracy
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR -ErrorAction SilentlyContinue).UBR
    if ($ubr) { $currentRevision = $ubr }

    Write-Host "OS: $($os.Caption) Build: $currentBuild.$currentRevision"

    # Patched build revisions from September 2026 Patch Tuesday
    # Map: major build -> minimum patched revision
    $patchedBuilds = @{
        14393 = 9512   # Windows Server 2016 / Win10 1607
        17763 = 9245   # Windows Server 2019 / Win10 1809
        19044 = 7725   # Windows 10 21H2
        19045 = 7725   # Windows 10 22H2
        22621 = 6500   # Windows 11 22H2 (estimated)
        22631 = 6500   # Windows 11 23H2 (estimated)
        26100 = 9445   # Windows 11 24H2
        26200 = 9445   # Windows 11 25H2
    }

    # Check for September 2026 KB
    $kbs = @('KB5122876','KB5122878','KB5124008')
    $installedKB = Get-HotFix -ErrorAction SilentlyContinue | Where-Object { $kbs -contains $_.HotFixID }

    if ($installedKB) {
        Write-Host "PATCHED - Found $($installedKB.HotFixID -join ', ')"
        exit 0
    }

    if ($patchedBuilds.ContainsKey($currentBuild)) {
        $requiredRevision = $patchedBuilds[$currentBuild]
        if ($currentRevision -ge $requiredRevision) {
            Write-Host "PATCHED - Build revision $currentBuild.$currentRevision >= $currentBuild.$requiredRevision"
            exit 0
        } else {
            Write-Host "VULNERABLE - Build $currentBuild.$currentRevision is below patched revision $currentBuild.$requiredRevision"
            Write-Host "Apply the September 2026 cumulative update immediately."
            exit 1
        }
    } else {
        Write-Host "UNKNOWN - Build $currentBuild not in known affected list. Verify manually against MSRC advisory."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - Error during check: $_"
    exit 2
}

Sources

1. Microsoft September 2026 Patch Tuesday - CybersecurityNews
2. September 2026 Patch Tuesday Zero-Days - SecurityOnline
3. September 2026 Patch Tuesday - NTCompatible
4. CVE-2026-20817 ALPC EoP PoC - oxfemale/GitHub
5. CVE-2026-20817 ALPC EoP Writeup - itm4n
6. Windows 11 KB5124008 September 2026 Update - Microsoft Support
7. Cryptika - September 2026 Patch Tuesday Analysis