Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day

Microsoft’s September Patch Tuesday closed an ALPC bug that lets code already running in a low-privilege AppContainer climb to SYSTEM. It is already in CISA’s KEV list. Bugs like this are how a browser exploit gets out of its sandbox.

This is not the Windows Update Stack zero-day fixed in the same release. It has its own CVE, fix and hunt.

CVE-2026-85880: a heap overflow in Windows ALPC

On September 8, 2026, Microsoft patched CVE-2026-85880, an Important elevation-of-privilege in Windows Advanced Local Procedure Call (ALPC). It’s a heap-based buffer overflow. Microsoft confirms exploitation in the wild.

An attacker who can already run code in a low-privilege AppContainer can exploit ALPC locally, with no extra user click, to escape the sandbox and reach SYSTEM. ALPC sits under RPC, COM and core services on every supported Windows SKU. That is why ALPC privilege escalations so often complete browser or document sandbox exploits.

CISA listed it in KEV on 2026-09-08 with a federal due date of September 22, 2026 and forensic triage under BOD 26-04.

The second stage of a browser exploit chain

A sandboxed RCE still needs a reliable privilege escalation before the attacker owns the machine. This bug supplies it. Expect it to be paired with browser or document sandbox exploits from the same period.

Do not mix this up with CVE-2026-81963 (Windows Update Stack link-following EoP). That is a separate September zero-day. Close both tickets, and track each as its own patch and hunt.

Install September updates and check build numbers

• Deploy September 2026 cumulative updates on workstations and servers.
• Confirm build numbers, not just “updates installed.”
• Prioritize endpoints with heavy sandboxed workloads (browsers, Office Protected View, AppContainer LOB apps).
• Track CVE-2026-85880 and CVE-2026-81963 as separate items in patch dashboards.
• Where policy requires it, treat pre-patch exposure windows as BOD 26-04 forensic candidates.

Details

• CVE: CVE-2026-85880 (CVSS 7.8, AV:L/AC:L/PR:L/UI:N)
• Type: Heap-based buffer overflow (CWE-122); uninitialized-resource characteristics (CWE-908)
• Impact: AppContainer / low privilege → SYSTEM (local, no UI)
• KEV: Added 2026-09-08; due 2026-09-22; ransomware use: Unknown
• Related but distinct: CVE-2026-81963 (Update Stack EoP) — different zero-day

Example fixed builds (not a full list; verify your SKU on MSRC): Windows 10 22H2 19045.7725; Server 2016 14393.9512; Server 2019 17763.9245; Server 2022 20348.5622.

Hunt / verify

• Look for privilege transitions from AppContainer / low integrity processes to SYSTEM near ALPC activity.
• Confirm September cumulative build numbers on representative workstation and server images.
• Keep ALPC and Update Stack remediation tickets on separate compliance lines so one closed ticket doesn’t hide the other.

Sources

• MSRC: CVE-2026-85880 — Windows ALPC Elevation of Privilege
• CISA KEV catalog — CVE-2026-85880 (due 2026-09-22)
• SecurityWeek: September 2026 Patch Tuesday / exploited zero-days
• CrowdStrike: September 2026 Patch Tuesday Analysis

Related: see every Microsoft vulnerability CISA added to its exploited list in 2026, with the fix for each and links to our coverage.

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].