CVE-2026-85880High· 7.8▾ Abyssal⚠ Exploited in the wild0dayPoC availableHeap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 42.9 · likelihood 0.1 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due Sep 22, 2026
0.6%
Last analysed / modified upstream
0.6% → 3.6%
Added to the CISA catalog on Sep 8, 2026. Federal remediation due Sep 22, 2026. View catalog ↗
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
windows_10_1607 < 10.0.14393.9512windows_10_1809 < 10.0.17763.9245windows_10_21h2 < 10.0.19044.7725windows_10_22h2 < 10.0.19045.7725windows_server_2012windows_server_2012 = r2windows_server_2016 < 10.0.14393.9512windows_server_2019 < 10.0.17763.9245windows_server_2022 < 10.0.20348.5622Upgrade past the affected range:
windows_10_1607 10.0.14393.9512windows_10_1809 10.0.17763.9245windows_10_21h2 10.0.19044.7725windows_10_22h2 10.0.19045.7725windows_server_2016 10.0.14393.9512windows_server_2019 10.0.17763.9245windows_server_2022 10.0.20348.5622Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96113Critical· 9.8Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
CVE-2025-62470High· 7.8Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-26175Medium· 4.6Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2026-26180High· 7.8Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-26156High· 7.8Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVE-2026-26176High· 7.8Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.