Advisory · CVE-2026-85880
ALPC sandbox escape hands attackers SYSTEM privileges
A heap-based buffer overflow in Windows ALPC lets code running in a low-privilege AppContainer escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms in-the-wild exploitation.
- Vendor
- Microsoft
- Product
- Windows
- Identifier / CWE
- CVE-2026-85880
CWE-122 - Action timing
- Sep 29, 2026
Explain it like I’m five
Programs in Windows pass notes to each other through a mailroom. A flaw in the mailroom lets a note from the least-trusted intern's desk get delivered with the boss's signature, opening every door in the building.
- 01Code in sandbox
An attacker already has code executing inside a low-privilege AppContainer, for example from a browser or document exploit.
- 02ALPC message crafted
The attacker sends a crafted message through Windows Advanced Local Procedure Call, the internal messaging system.
- 03Heap overflow
The message triggers a heap-based buffer overflow in the ALPC driver code.
- 04Sandbox escaped
The attacker breaks out of the AppContainer and gains SYSTEM privileges with no further user interaction.
What happened
Microsoft’s September 8, 2026 Patch Tuesday fixed CVE-2026-85880, a heap-based buffer overflow (CWE-122) in Windows Advanced Local Procedure Call (ALPC), the internal messaging system that lets Windows programs communicate. An attacker who can already execute code in a low-privilege AppContainer can exploit the flaw locally to escape the sandbox and elevate to SYSTEM, with no additional user interaction required. Microsoft lists the vulnerability as exploited in the wild. Researchers at Volexity and Proofpoint are credited with the report. It carries CVSS 7.8 and is rated Important; affected products include Windows 10 and Windows Server 2012, 2016, 2019, and 2022. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 8, 2026.
What to do
- Install the September 2026 Windows security updates across the fleet; there is no workaround.
- Prioritize multi-user systems, exposed workstations, and servers where local code execution paths are available.
- Do not confuse this with CVE-2026-81963, the separate Windows Update Stack zero-day from the same Patch Tuesday: track and close both, but treat them as distinct patch and hunt stories.
- Review endpoint telemetry for sandbox-origin activity during the exposure window, since this flaw completes exploit chains that begin with browser or document sandbox escapes.
Management note
A browser exploit without a privilege escalation is half an attack kit; this ALPC flaw is the other half, turning a contained sandbox compromise into full SYSTEM control. It was already being exploited before the patch, and it sits beneath RPC, COM, and core services on every supported Windows build. Patching is straightforward, but pairing it with a hunt for the first-stage foothold is what actually closes the incident.