A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) can be triggered by a legitimate local user interacting with the service. The flaw allows the attacker to overwrite critical memory structures and subsequently obtain SYSTEM-level privileges on the affected machine, thereby compromising confidentiality, integrity, and availability of the system. This vulnerability is categorized as CWE-122, Memory Management: Uncontrolled Buffer or Return Pointer Size Error.

The flaw affects Microsoft Windows 10 and Windows 11 desktop releases and a range of Windows Server editions. Specifically, it is present in Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and the 26H1 minor release; and Windows Server 2012 through 2025, including the Server Core variants of 2012, 2012 R2, 2016, 2019, 2022, and 2025. All architectures, including x86, x64, and arm64, are also impacted as enumerated by the documented CPE attributes.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no public exploit has been reported at the time of analysis. Because the attack requires the attacker to already have local user credentials and sufficient privileges to interact with BITS, the attack vector is local. However, once the buffer overflow is exploited, the attacker can gain SYSTEM privileges, giving full control over the affected host.