Windows ALPC local privilege escalation (CVE-2026-85880)

Actively exploited in the wild - CVE-2026-85880 is a high-severity heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC) that lets an authorized local attacker escalate privileges to SYSTEM. Microsoft has released patches in the January 2026 security update; deploy immediately.

Overview

CVE-2026-85880 is a heap-based buffer overflow vulnerability in the Windows ALPC component, a core inter-process communication mechanism used across the operating system. An attacker who already has a foothold on a system - through malware, a compromised user account, or another exploit - can leverage this flaw to run arbitrary code with elevated privileges.

The vulnerability carries a CVSS score of 7.8 (High), with a local attack vector, low attack complexity, low privileges required, and no user interaction needed. This means exploitation does not require any special conditions or victim action beyond the attacker already having local access.

Impact

Successful exploitation grants the attacker SYSTEM-level privileges, the highest access tier on a Windows machine. From there, an attacker can disable security software, install persistent backdoors, steal credentials, move laterally across the network, and access sensitive data stored on the compromised host.

The vulnerability has been confirmed by CISA as actively exploited in the wild, indicating real-world attackers have already incorporated it into their operations. Notably, state-sponsored Lazarus Group actors have been observed exploiting Windows zero-days in Dream Job attacks, underscoring how quickly ALPC flaws can be weaponized by sophisticated threat actors.

Remediation

Microsoft addressed CVE-2026-85880 in the January 2026 Patch Tuesday release. Organizations should:

1. Apply the latest Windows security updates immediately across all affected systems, prioritizing domain controllers, servers, and high-value endpoints
2. Check Microsoft’s security response center advisory for specific affected Windows versions
3. If immediate patching is not possible, limit local user privileges and enforce application allowlisting as interim mitigations

Related recent Windows activity includes the KB5079391 update rolling out Smart App Control improvements, which can help block malicious binaries in environments where patching lags.

Security Insight

This ALPC overflow follows a pattern of Windows kernel and IPC vulnerabilities being chained with initial access payloads, as seen with Russian espionage toolkits that hijack RDP sessions via malicious LNK files. The low privilege requirement makes this an attractive post-exploitation ladder rung, and its presence on CISA’s Known Exploited Vulnerabilities list confirms threat actors value reliable local escalation chains. Microsoft’s ongoing struggle to harden ALPC - a component with decades of legacy code - suggests similar flaws will continue to surface, making rapid patch deployment a non-negotiable security control rather than an optional best practice.

Further Reading

• Lazarus exploits Windows zero-day in Dream Job attacks
• Russian CTRL Toolkit Hijacks RDP via Malicious LNK
• Windows 11 KB5079391 update rolls out Smart App Control
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs