Windows ALPC: heap overflow gives a local user privilege escalation to SYSTEM

Impact

A heap-based buffer overflow in ALPC, the local IPC mechanism every Windows service uses to talk to privileged components, lets an authorized local user elevate. ALPC is not an optional role - it is present and reachable from any process on the box, so there is no configuration that removes the exposure. The affected list is the long-tail estate: Windows 10 1607/1809/21H2/22H2 and Windows Server 2012 and 2012 R2, which in a datacenter usually means old management servers, license servers, and appliance-like Windows hosts nobody wants to touch. CISA lists it as exploited in the wild. Server 2012 and 2012 R2 are out of mainstream support and only get this fix through extended security updates, so many operators will not have the patch available at all.

Who can reach it

Any local authenticated user or compromised service account on an affected Windows host. No user interaction, no special privilege beyond a foothold. Not remotely reachable by itself.

What to do

Install the September 2026 update for the affected SKU; MSRC carries the per-SKU KB numbers. For Windows Server 2012 and 2012 R2 this requires an active Extended Security Updates subscription - without one there is no fix and the host must be isolated or retired. Patching requires a reboot, so plan a per-node window. Because ALPC is always present, there is no mitigating configuration change; reducing who can log on interactively or run code on these hosts is the only stopgap.

References

Related entries

• Linux kernel sunrpc: use-gss-proxy proc entry published before its mutex is initializedCVE-2026-89540 · Linux kernel sunrpc/auth_rpcgss (use-gss-proxy procfs entry, gssp_lock init ordering)High
• Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dumpCVE-2026-89690 · Linux kernel nfsd (nfsd4_release_compoundargs / rpc_status netlink dump)High
• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High
• Linux kernel mm/mempolicy: device-private PMD from GPU THP migration decoded as a PFN, yielding a bogus folioCVE-2026-89758 · Linux kernel mm/mempolicy (queue_folios_pmd, device-private PMD handling)High
• Linux kernel mm/swap: hibernation slot freed while cached corrupts unrelated processes' memoryCVE-2026-89760 · Linux kernel mm/swap (hibernation slot freed while in the swap cache)High