CVE-2026-85905

Executive Summary

CVE-2026-85905 is a heap-based buffer overflow (CWE-122) in the Windows UI Immersive Server component, a core user-interface subsystem of Microsoft Windows. An attacker who already holds a low-privileged local account can trigger the overflow to corrupt heap memory and elevate to a higher-integrity context, including SYSTEM. With a CVSS base score of 8.8 and a scope-changed impact vector (S:C) affecting confidentiality, integrity, and availability, this is a high-priority local privilege-escalation issue for any multi-user or host exposing interactive sessions.

Technical Analysis

The vulnerability class is a heap-based buffer overflow, mapped to CWE-122. This class of defect occurs when a process writes data beyond the boundaries of a heap-allocated buffer, overwriting adjacent heap metadata and adjacent object allocations. In the context of the Windows UI Immersive Server, this component brokers both the modern (immersive/Shell) and classic user-interface surfaces — window composition, shell frame management, and the boundary between the interactive desktop and the immersive shell. Because this is a user-interactive UI subsystem, the component is reachable by any locally logged-on user and is typically hosted inside a privileged Windows process.

The NVD description explicitly states the required attacker position: "an authorized attacker" — meaning a legitimate but low-privileged local user, with PR:L in the CVSS vector. The attack requires no user interaction (UI:N) and has low attack complexity (AC:L). The overflow is local (AV:L). The scope-changed metric (S:C) is significant: it indicates that a successful exploit can affect resources beyond the security scope of the vulnerable component itself, which is consistent with gaining code execution in a higher-integrity process than the one the attacker is interacting with.

A heap overflow exploitable in a privileged UI process is typically converted into code execution by corrupting heap chunk metadata or adjacent object pointers, then redirecting control flow through the resulting write-what-where primitive. Specific function names, internal structures, heap allocation routines, and the exact overflow trigger point are not disclosed in the available CNA/NVD data. Rather than speculate on implementation specifics, analysts should treat the component (Windows UI Immersive Server) as the attack surface and the heap-corruption primitive as the exploitation mechanism. No public proof-of-concept, exploit code, or Nuclei template is available for this CVE.

Exploitation Scenarios

The following attack chain is written at the vulnerability-class level because no public PoC exists and the description does not disclose specific functions, endpoints, or file paths. No implementation-level detail beyond the CNA/NVD text is asserted.

1. Reconnaissance / target identification. The attacker requires an existing, low-privileged interactive session on a Windows host. This typically means a standard user account obtained through credential phishing, a compromised remote-access session, or a low-integrity beachhead following an application compromise. Because the component is local, there is no remote network exposure to scan for; reconnaissance focuses on identifying hosts that host multiple user sessions (RDS/VDI, jump hosts) where a standard privilege level is available.

2. Triggering the flaw class. The attacker interacts with the Windows UI Immersive Server (the immersive/shell user-interface subsystem). By supplying crafted UI input — the exact malformed input is not specified in available data — the attacker causes the UI subsystem to process data of an unexpected length, resulting in a heap buffer being written past its bounds. Under CWE-122, this overwrites adjacent heap allocations and can corrupt heap metadata or pointers belonging to neighboring objects. Because the vulnerable code runs in a privileged process, the attacker is corrupting memory they would not normally be authorized to write.

3. Payload/execution at the class level. Following a heap corruption primitive, exploitation of a buffer overflow in a privileged Windows process generally proceeds via control-flow hijack or object-pointer overwrite, permitting execution of attacker-controlled code under the integrity level of the hosting process. The available data does not disclose the target process name, the corrupted object type, or a specific technique (e.g., overwrite of a virtual function pointer or a data-only corruption to grant the attacker token rights). No public exploit is known (POC_STATUS: None), so exploitability should be considered probable but unconfirmed.

4. Post-exploitation impact. Per the CVSS vector, successful exploitation yields High confidentiality, integrity, and availability impact with a scope change. The practical outcome is local privilege elevation — commonly to SYSTEM — giving the attacker full control over the host, the ability to disable security tooling, dump credential material, and establish persistence. Scope change implies the compromise can extend beyond the vulnerable component's security boundary to other processes and system resources on the same machine.

Caveat: Because no exploit is public and the vendor has not published a fixed version, the attack chain above is inferred from the vulnerability class (CWE-122) and the CVSS environmental assumptions (local, authorized, low-privilege, no interaction). It should not be read as a validated exploitation sequence.

Impact Assessment

Business impact is high for affected Windows endpoints and, particularly, multi-session hosts. CVSS subscores: AV:L (local attack vector) limits exposure to attackers with an existing session; PR:L requires only low privileges, so any standard user — including a compromised service or RDP user — qualifies; UI:N (no user interaction) removes the need to trick an administrator; AC:L (low complexity) suggests the trigger is straightforward once an attacker has a suitable session. S:C with C:H/I:H/A:H means successful exploitation compromises confidentiality, integrity, and availability across the affected host with impact extending beyond the original security scope.

Blast radius is largest on Remote Desktop Services / VDI / Citrix-style session hosts and privileged jump servers, where one low-privileged foothold can be escalated to full host control and then pivot to other users' sessions and credentials. Single-user workstations are nominally less exposed because the attacker must already hold a local account, but the impact per host is still total compromise. No EPSS score is available (FIRST.org has not yet scored this CVE), and the CVE is not in CISA KEV, so there is no current evidence of mass exploitation; the primary risk is targeted and post-compromise escalation by an attacker who already has a foothold.

Detection Guidance

Because no PoC, payload, or specific function is disclosed, the rules below target the general indicators of a local heap-overflow privilege-elevation in Windows UI processes: anomalous behavior of immersive/shell user-interface processes, privilege changes by non-administrative accounts, and suspicious post-exploitation activity.

Sigma Rule

title: Potential Local Privilege Escalation via Windows UI Immersive Server Heap Overflow (CVE-2026-85905)
id: 6b9f2c1e-3d47-4a2b-9c05-85905cve00a
status: experimental
description: Detects a low-privileged process spawning or injecting into Windows immersive/shell UI host processes, consistent with exploitation of a heap-based buffer overflow in the Windows UI Immersive Server.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85905
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-85905
logsource:
  product: windows
  category: process_creation
detection:
  selection_children:
    ParentImage|endswith:
      - '\\explorer.exe'
      - '\\userinit.exe'
      - '\\rdpclip.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\rundll32.exe'
      - '\\regsvr32.exe'
  selection_integrity:
    IntegrityLevel: 'System'
    User|endswith:
      - '\\Users\\*'
  condition: selection_children or selection_integrity
falsepositives:
  - Legitimate administrative scripts launched by standard users on shared hosts
  - Software deployment and login scripts
level: medium

YARA Rule

rule CVE_2026_85905_Win_UIImmersiveServer_HeapOverflow_Indicator
{
    meta:
        description = "Heuristic indicator for exploit tooling targeting CVE-2026-85905 heap-based buffer overflow in Windows UI Immersive Server"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85905"
        cve = "CVE-2026-85905"
        severity = "high"

    strings:
        $cve1 = "CVE-2026-85905" ascii wide nocase
        $kw1  = "ImmersiveServer" ascii wide nocase
        $kw2  = "UIImmersiveServer" ascii wide nocase
        $kw3  = "heap spray" ascii wide nocase
        $kw4  = "heap overflow" ascii wide nocase
        $kw5  = "elevate privileges" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        (filesize < 5MB) and
        (2 of ($kw*) or $cve1)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-85905 Potential Windows UI Immersive Server Privilege Escalation - Post-Exploitation C2 Beacon"; flow:established,to_server; content:"|7b 22|"; content:"CVE-2026-85905"; nocase; threshold:type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; reference:cve,2026-85905; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85905; sid:8590501; rev:1;)

Note: CVE-2026-85905 is a local privilege-escalation flaw with no network-reachable attack surface, so no direct exploitation traffic exists on the wire. The Suricata rule above detects post-exploitation artifacts and known-exploit references rather than the local trigger itself; network detection is inherently limited for this class of CVE.

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("explorer.exe", "userinit.exe", "rdpclip.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "regsvr32.exe") and
  process.user.name != null and not user.name : ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")

Splunk SPL Query

index=windows (sourcetype=WinEventLog:Security OR sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational)
(EventCode=4688 OR EventCode=1)
| eval proc=coalesce(New_Process_Name, Image)
| eval parent=coalesce(Parent_Process_Name, ParentImage)
| eval acct=coalesce(Account_Name, User)
| where match(parent, "(?i)(explorer|userinit|rdpclip)\.exe$")
    AND match(proc, "(?i)(cmd|powershell|pwsh|rundll32|regsvr32)\.exe$")
| stats count min(_time) as first_seen max(_time) as last_seen values(proc) as spawned by acct, parent
| where acct != "SYSTEM"
| search NOT acct IN ("SYSTEM","LOCAL SERVICE","NETWORK SERVICE")

Wazuh OSSEC Rule

<group name="windows,cve_2026_85905,privilege_escalation,">
  <rule id="100905" level="12">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.parentImage">explorer\.exe|userinit\.exe|rdpclip\.exe</field>
    <field name="win.eventdata.image">\\cmd\.exe|\\powershell\.exe|\\pwsh\.exe|\\rundll32\.exe</field>
    <description>CVE-2026-85905: Low-privileged user on Windows UI Immersive Server spawns shell/interpreter - possible local privilege escalation.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>windows,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround is currently available for CVE-2026-85905. The guidance below is defense-in-depth against local privilege-escalation exploits of the CWE-122 class and must not be represented as a fix.

1. Immediate mitigations:

• Treat any Windows host granting multiple users a standard-privilege interactive session (RDS, VDI, jump hosts) as at elevated risk. Restrict who can log on locally and over RDP, and apply least-privilege so that standard-user sessions are limited wherever possible.
• Enable and tune Microsoft Defender exploit protection (ASLR enforcement, heap integrity / Terminate on Heap Corruption, Control Flow Guard) across managed endpoints — heap corruption mitigations directly raise the cost of exploiting CWE-122 defects.
• Enforce Credential Guard and LSASS protection so that a successful elevation cannot be trivially converted into domain-wide credential theft, and enable LSA protection.
• Restrict session host exposure: require network-level authentication, MFA, and jump-host access with session recording for privileged sessions.
• Alert on privilege transitions and integrity-level escalation by non-administrative accounts as a compensating detective control.

2. Patch/upgrade steps:

• Monitor Microsoft Security Update Guide, the MSRC blog, and the NVD entry for CVE-2026-85905. When a fixed Windows cumulative update (or Servicing Stack update) is published, test and roll it out on an accelerated schedule for internet-facing, shared-session, and privileged-access hosts.
• Because no patch exists today, do not attempt to remediate by editing or disabling the Windows UI Immersive Server component; doing so can destabilize the interactive shell. Wait for an official Microsoft fix.

3. Long-term hardening:

• Maintain a vulnerability management process that ingests CVE/NVD/CISA feeds and prioritizes local privilege-escalation CVEs on multi-user hosts separately from remote code execution.
• Segment shared-session hosts from high-value assets to limit post-exploitation blast radius.
• Keep endpoint detection and response telemetry for process creation, integrity-level changes, and suspicious child processes of shell/UI hosts.
• Regularly review Windows interactive logon rights and remove standard-user interactive access on servers that do not require it.

References

• NVD entry for CVE-2026-85905: https://nvd.nist.gov/vuln/detail/CVE-2026-85905
• CWE-122, Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• MITRE ATT&CK T1068, Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Microsoft Security Update Guide / MSRC (monitor for a CVE-2026-85905 fix and advisory): https://msrc.microsoft.com/update-guide
• CISA Known Exploited Vulnerabilities Catalog (monitor for future addition; not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template is known for CVE-2026-85905. No EPSS score has been published by FIRST.org. The CVE is not currently listed in CISA KEV, and no threat-actor campaign or exploit-in-the-wild evidence is associated with it in the available data.