CVE-2026-85880

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Microsoft WindowsOperating systems

CVSS

7.8High

ExploitationExploited in the wildAdded to KEV 8 Sep 2026CISA KEV

Exploit odds (EPSS)3.62%Chance of exploitation activity in the next 30 days, higher than 89% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in10.0.14393.9512Also 10.0.17763.9245, 10.0.19044.7725 and 4 moreCVE List

Federal deadline22 Sep 2026Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV

What fixes it

10.0.14393.9512Windows 10 Version 1607CVE List
10.0.17763.9245Windows 10 Version 1809CVE List
10.0.19044.7725Windows 10 Version 21H2CVE List
10.0.19045.7725Windows 10 Version 22H2CVE List
6.2.9200.26349Windows Server 2012CVE List
6.2.9200.26349Windows Server 2012 (Server Core installation)CVE List

Show all 13 fixed versions

6.3.9600.23398Windows Server 2012 R2CVE List
6.3.9600.23398Windows Server 2012 R2 (Server Core installation)CVE List
10.0.14393.9512Windows Server 2016CVE List
10.0.14393.9512Windows Server 2016 (Server Core installation)CVE List
10.0.17763.9245Windows Server 2019CVE List
10.0.17763.9245Windows Server 2019 (Server Core installation)CVE List
10.0.20348.5622Windows Server 2022CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

8 Sep 2026Added to CISA KEVCISA KEV
8 Sep 2026, 17:14 UTCPublishedCVE List

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

@getpokemon7.bsky.social: 中国のハッカーがChromeとWindowsのゼロデイ脆弱性を悪用し、CLEANGULPマルウェアを拡散 UTA0565というコードネームを持つ中国の脅威アクターが、最近明らかになったGoogle ChromeとMicrosoft Windowsの脆弱性を悪用し、偽のウェブサイトを通じてゼロデイ攻撃を行っていることが確認された。 2026年9月3日と4日に検Bluesky: zero-day, 21 Oct 2026

Description

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Text from CVE List

Affected versions 13

Windows 10 Version 1607affected: 10.0.14393.0 before 10.0.14393.9512CVE List
Windows 10 Version 1809affected: 10.0.17763.0 before 10.0.17763.9245CVE List
Windows 10 Version 21H2affected: 10.0.19044.0 before 10.0.19044.7725CVE List
Windows 10 Version 22H2affected: 10.0.19045.0 before 10.0.19045.7725CVE List
Windows Server 2012affected: 6.2.9200.0 before 6.2.9200.26349CVE List
Windows Server 2012 (Server Core installation)affected: 6.2.9200.0 before 6.2.9200.26349CVE List
Windows Server 2012 R2affected: 6.3.9600.0 before 6.3.9600.23398CVE List
Windows Server 2012 R2 (Server Core installation)affected: 6.3.9600.0 before 6.3.9600.23398CVE List
Windows Server 2016affected: 10.0.14393.0 before 10.0.14393.9512CVE List
Windows Server 2016 (Server Core installation)affected: 10.0.14393.0 before 10.0.14393.9512CVE List
Windows Server 2019affected: 10.0.17763.0 before 10.0.17763.9245CVE List
Windows Server 2019 (Server Core installation)affected: 10.0.17763.0 before 10.0.17763.9245CVE List
Windows Server 2022affected: 10.0.20348.0 before 10.0.20348.5622CVE List