MicrosoftCVE-2026-85880

Microsoft Windows ALPC: heap buffer overflow

High7.8CVE-2026-85880 · Published Sep 8, 2026 · updated Sep 24, 2026

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Windows 10 Version 1607 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows 10 Version 1809 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows 10 Version 21H2 Product	>= 10.0.19044.0, < 10.0.19044.7725	10.0.19044.7725
Windows 10 Version 22H2 Product	>= 10.0.19045.0, < 10.0.19045.7725	10.0.19045.7725
Windows Server 2012 Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 (Server Core installation) Product	>= 6.2.9200.0, < 6.2.9200.26349	6.2.9200.26349
Windows Server 2012 R2 Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398
Windows Server 2012 R2 (Server Core installation) Product	>= 6.3.9600.0, < 6.3.9600.23398	6.3.9600.23398
Windows Server 2016 Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows Server 2016 (Server Core installation) Product	>= 10.0.14393.0, < 10.0.14393.9512	10.0.14393.9512
Windows Server 2019 Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245
Windows Server 2019 (Server Core installation) Product	>= 10.0.17763.0, < 10.0.17763.9245	10.0.17763.9245

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-122, CWE-908

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Sep 8	Microsoft Skype for Business: spoofing High8.3Sep 8 CVE-2026-696466.0.9319.885+2 more	High8.3	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: cross-site scripting Medium6.5Sep 8 CVE-2026-696426.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: spoofing High7.1Sep 8 CVE-2026-663056.0.9319.885+2 more	High7.1	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: information disclosure Medium6.5Sep 8 CVE-2026-663066.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: integer overflow High7.5Sep 8 CVE-2026-663076.0.9319.885+2 more	High7.5	6.0.9319.885+2 more
Sep 8	Microsoft Skype for Business: out-of-bounds read Medium6.5Sep 8 CVE-2026-663086.0.9319.885+2 more	Medium6.5	6.0.9319.885+2 more

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.