HIGHVulnerability
Verified
Global

CISA KEV: Microsoft Windows — Microsoft Windows Heap-Based Buffer Overflow Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Analysis

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. Added to CISA Known Exploited Vulnerabilities catalog on 2026-09-08. Remediation due: 2026-09-22.

Indicators of Compromise (1)

CVE (1)
CVE-2026-85880
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Sep 8, 2026. Verified by: CISA.

Related Threats

CRITICALZero Day

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware

A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on September 3 and 4, 2026, involved the chaining of two vulnerabilities in Chrome (CVE-2026-85046, CVE-2026-87491) and one impacting Windows Advanced Local Procedure Call (CVE-2026-85880) to break

CVE-2026-85046CVE-2026-87491
The Hacker News
CRITICALZero Day

Attackers are weaponizing the gap between Chromium fixes and Chrome patches

A new exploit kit is revealing the perils of the “patch later” mentality. According to the Proofpoint Threat Research team , espionage-motivated threat actors are using a new malicious toolkit to chain together four separate Chrome browser and Microsoft Windows vulnerabilities to allow them to launch targeted spear phishing campaigns. Proofpoint, which researched the new attack method along with G

CVE-2026-85046CVE-2026-87491
CSO Online
CRITICALZero Day

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Possibly wormable bugs and two zero-day holes highlight the almost 1,000 fixes issued today by Microsoft in its September Patch Tuesday release . The 964 vulnerabilities, another record since Microsoft began using AI in the middle of the year to find holes, require customer action. Excluded are 174 third-party/open-source CVEs and 23 Chromium/Edge CVEs, as well as nine Microsoft mitigated vulnerab

CVE-2026-85880CVE-2026-81963
CSO Online