Windows ALPC CVE-2026-85866

Exploitation requires the attacker to already be a locally authenticated, low-privileged user on the target Windows host (AV:L, PR:L) and to interact with the Windows ALPC (Advanced Local Procedure Call) inter-process communication subsystem. The AC:H rating indicates a non-trivial precondition - most likely a race condition or specific system state the attacker must achieve for the leak to occur. Limiting factors that reduce real-world risk: no remote vector (local access mandatory), no anonymous/unauthenticated path, high attack complexity, and impact restricted to disclosure of sensitive information (no integrity or availability impact). Affected builds span Windows 10 (21H2/22H2/1809), Windows 11 (23H2 through 26H2), and Windows Server 2019/2022/2025; patched builds are enumerated in the EUVD advisory (e.g., Server 2025 fixed in 10.0.26100.33650).

This is a genuinely low-priority vulnerability despite affecting a ubiquitous platform. All signals align toward low real-world risk: the CVSS 3.1 base score is 4.7 (Medium), and its vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) requires LOCAL access, HIGH attack complexity, and existing LOW privileges - meaning the attacker must already be an authenticated local user and must win a race or meet specific conditions implied by AC:H. CISA's SSVC framework reinforces this with Exploitation: none, Automatable: no, and Technical Impact: partial, indicating no observed exploitation and no reliable mass-automation path. There is no CISA KEV listing and no public POC identified. EPSS was not provided in the input, so exploitation probability cannot be independently quantified. The impact is confined to information disclosure (C:H, I:N, A:N) - an attacker can read sensitive system information via the Windows ALPC (Advanced Local Procedure Call) subsystem but cannot modify data or affect availability, and scope is Unchanged. Net assessment: a high-prevalence-product but low-real-risk issue, best treated as a routine patch-cycle item rather than an emergency, barring new exploitation evidence.

A locally authenticated low-privileged user runs a crafted program that abuses the Windows ALPC interface to read sensitive system information it should not be able to access, potentially aiding later privilege-escalation steps. The high attack complexity (AC:H) suggests the attacker must satisfy a specific timing or state condition to reliably trigger the leak. No public exploit code has been identified at the time of analysis.