Search: CVE-2026-85880

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

In September 2026, the Chinese threat actor UTA0565 exploited unpatched zero-day vulnerabilities in Google Chrome and Microsoft Windows through phishing campaigns targeting Asian government entities. The attacker used fake domains impersonating legitimate organizations to deliver an exploit chain leveraging CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Successful exploitation resulted in deployment of CLEANGULP, a previously undocumented malware family with backdoor capabilities including command execution, file operations, and beacon object file execution. CLEANGULP communicated with command-and-control servers using encrypted HTTP traffic with custom encoding. Multiple Chinese APT groups shared access to this exploit kit, indicating coordinated cyber espionage activity during the vulnerability window. Patch status is not yet confirmed; organizations should monitor vendor advisories and apply patches once available.