Windows ALPC CVE-2026-85880

Exploitation requires an existing low-privileged local authenticated session on the target Windows host (AV:L, PR:L); the attacker must be able to execute code on the machine and communicate with ALPC ports locally. No network connectivity, no user interaction, and no elevated privileges are needed beyond an ordinary user account. What limits exploitation is the requirement for prior local code execution - purely remote attackers cannot directly trigger this flaw without first achieving some form of local access. All standard Windows desktop and server configurations with ALPC enabled (i.e., all Windows installs) are susceptible; no special feature flag or non-default configuration is required.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a low-complexity local privilege escalation with total system impact once triggered by any authenticated low-privileged user - even a mid-sized municipal IT team in sopot operating a mixed Windows Server 2019/2022 estate should treat this as an urgent patching priority, since any compromised standard user account becomes a full SYSTEM-level foothold. SSVC signals Exploitation: none and Automatable: no, meaning worm-scale or automated mass exploitation is not currently observed or anticipated, which moderates the immediate urgency versus a KEV-listed issue. Technical Impact is rated total, consistent with the C:H/I:H/A:H CVSS impact block. The combination of low attack complexity, no user interaction required, and total impact makes this a high-value post-exploitation tool if an attacker already has local code execution; the main limiting factor is the requirement for existing local authenticated access (AV:L, PR:L), ruling out remote-only attack chains.

An attacker who has obtained a low-privileged local user account - via phishing, credential theft, or prior exploitation - connects to a vulnerable ALPC port and submits a specially crafted message with a malformed length field, triggering a heap buffer overflow in kernel memory. The overflow corrupts an adjacent kernel heap structure, redirecting execution flow to attacker-controlled data. The attacker gains SYSTEM-level privileges, enabling full persistence, credential dumping via LSASS, and lateral movement. No public proof-of-concept is known at time of analysis.