The flaw lies in an uninitialized resource used by Windows Background Intelligent Transfer Service (BITS), allowing a local user with permission to acquire elevated privileges. This elevation grants SYSTEM level access to the receiving system, affording the attacker full control over the affected machine. The weakness is classified as CWE‑908, where improper handling of uninitialized data can lead to privilege escalation.

Affected are numerous Windows 10 and Windows 11 releases, including Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 build 23H2, 24H2, 25H2, and 26H2. Windows Server editions from 2012 through 2025 (both core and full installations) are also impacted.

With a CVSS score of 7.8, the vulnerability is considered high severity. The EPSS score is unavailable, implying limited public exploitation data, and the issue is not listed in CISA’s KEV catalog. The exploit requires local authorized access, making it most relevant to administrators with elevated privileges. Prompt remediation is recommended to prevent potential local privilege escalation attacks.