Microsoft September 2026 Patch Tuesday Zero Day-- CVE-2026-85880 ALPC Heap Overflow LPE Crash-then-Elevate Pattern

Ankit Mehta@Secvyn

•updated Sep 8, 2026•2•0•13

Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.