Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalation

Windows Advanced Local Procedure Call (ALPC) contains a heap-based buffer overflow that allows privilege escalation from within a low-privilege AppContainer. An attacker who has achieved code execution inside an AppContainer sandbox can trigger the overflow to escape the sandbox boundary and escalate privileges on the local system.

ALPC is Windows’ internal high-speed inter-process communication (IPC) mechanism. It handles message passing between kernel-mode components and user-space processes. Because ALPC messages cross privilege boundaries, vulnerabilities in its message-handling code can let a process operating at low privilege influence operations that run at a higher level.

AppContainer is the sandbox model used for Universal Windows Platform (UWP) applications and browser content processes, including Microsoft Edge. It restricts the contained process’s access to the file system, registry, network interfaces, and kernel objects. Escaping an AppContainer converts a sandboxed code execution primitive into a process running with the logged-in user’s rights, which an attacker can then combine with a further privilege escalation step to reach SYSTEM.

A heap buffer overflow occurs when a process writes past the end of an allocated heap buffer, overwriting adjacent memory. In this case, the overflow occurs in ALPC’s message-parsing code. A process inside an AppContainer can send a crafted ALPC message that overwrites adjacent heap structures, corrupting control data or object pointers in a way that gives the process elevated access to memory it should not reach.

Patched September 8, 2026 as part of Microsoft’s record September Patch Tuesday, which addressed 974 CVEs total. CISA added CVE-2026-85880 to its Known Exploited Vulnerabilities catalog the same day. Federal agencies must apply mitigations by September 22, 2026 per BOD 26-04.

CVE-2026-85880 and CVE-2026-81963, a Windows Update Stack link-following privilege escalation also patched September 8, share the same CVSS 7.8 severity rating and the same CISA KEV remediation deadline. Both require an existing foothold on the machine; neither is directly remotely exploitable on its own. CISA’s active-exploitation confirmation on both means they appear in real intrusion chains, typically as the privilege escalation step after initial access is established.

The flaw is not remotely exploitable on its own: local code execution is a required precondition. In active intrusions, that precondition is typically already met before privilege escalation is needed.

CISA also added CVE-2026-75650 (Adobe Commerce, CVSS 10.0) and CVE-2026-86218 (N-able N-central, CVSS 10.0) to the KEV catalog in the same September 8 batch.

For full Patch Tuesday context, see Microsoft Patches Record 974 Vulns, 2 Zero-Days.