Loading vulnerability…
Windows ALPC Heap Buffer Overflow Privilege Escalation
CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that allows a low-privileged local attacker to escape an AppContainer sandbox and elevate privileges to SYSTEM. It affects multiple Windows client and server releases. Observed BlueMoon exploitation uses ALPC communication and Windows Notification Facility (WNF) mechanisms to obtain kernel read/write access and modify process-token privileges. The vulnerability was actively exploited before Microsoft released security updates on September 8, 2026, and was added to CISA's Known Exploited Vulnerabilities Catalog that day.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise system confidentiality, integrity, and availability by granting SYSTEM-level privileges. An attacker with an existing local foothold can cross sandbox and operating-system privilege boundaries, enabling privileged code execution and malware deployment. BlueMoon campaigns chained this vulnerability with Chromium vulnerabilities CVE-2026-85046 and CVE-2026-87491 to move from browser compromise to execution outside the renderer sandbox; CVE-2026-85880 alone is not a remote initial-access vulnerability.
If you can’t patch tonight, do this now.
No vulnerability-specific workaround is identified. Pending patch deployment, restrict local access and execution by untrusted users, enforce least privilege, and isolate unpatchable systems. Monitor for unexpected process-token privilege changes, SYSTEM-level execution, browser-to-parent-process injection, and unusual payload execution originating from browser activity. These measures reduce exposure but do not replace the Windows security update.
Patch, then assume compromise.
Apply the applicable Microsoft September 2026 security updates or superseding cumulative updates immediately and verify successful installation. Minimum fixed builds identified for affected releases are: Windows 10 1607 and Windows Server 2016, 10.0.14393.9512; Windows 10 1809 and Windows Server 2019, 10.0.17763.9245; Windows 10 21H2, 10.0.19044.7725; Windows 10 22H2, 10.0.19045.7725; Windows Server 2012, 6.2.9200.26349; Windows Server 2012 R2, 6.3.9600.23398; and Windows Server 2022, 10.0.20348.5622. Applicable Server Core installations also require updates. Patch Chromium-based browsers to interrupt the observed BlueMoon chain. Investigate potentially compromised endpoints because patching does not remove previously installed malware or persistence.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
181 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.