CVE-2026-85880

Name of the Vulnerable Software and Affected Versions Windows 10 versions 1607 through 10.0.14393.9511 Windows 10 versions 1809 through 10.0.17763.9244 Windows 10 versions 21H2 through 10.0.19044.7724 Windows 10 versions 22H2 through 10.0.19045.7724 Windows Server 2012 versions prior to 6.2.9200.26349 Windows Server 2012 R2 versions prior to 6.3.9600.23397 Windows Server 2016 versions prior to 10.0.14393.9512 Windows Server 2019 versions prior to 10.0.17763.9245 Windows Server 2022 versions prior to 10.0.20348.5622

Description An issue exists in the Windows Advanced Local Procedure Call (ALPC), a fast local messaging facility. The flaw involves a heap-based buffer overflow—where data exceeds a heap allocation and may corrupt neighboring memory—and the use of an uninitialized resource, which occurs when code accesses a resource before its expected state exists. An authorized attacker who can execute code within a low-privilege AppContainer can exploit this to escape the sandbox and elevate privileges to NT AUTHORITYSYSTEM. Microsoft and CISA have confirmed that this issue is being actively exploited in the wild.

Recommendations For Windows 10 version 1607, install update KB5123099 and restart the system. For Windows 10 version 1809, install update KB5122876 and restart the system. For Windows 10 versions 21H2 and 22H2, install update KB5122878 and restart the system. For Windows Server 2012, install the KB5123065 monthly rollup and restart the system. For Windows Server 2012 R2, install the KB5123066 monthly rollup and restart the system. For Windows Server 2016, install update KB5123099 and restart the system. For Windows Server 2019, install update KB5122876 and restart the system. For Windows Server 2022, install update KB5122882 and restart the system.