A heap‑based buffer overflow exists in the Windows Background Intelligent Transfer Service (BITS). An attacker who already has local authorization can exploit this flaw to raise their privileges, potentially achieving full system control. The weakness is a classic examples of heap corruption, as identified by CWE-122.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7.8 indicates a moderate‑to‑high severity, and although the EPSS score is not available, the fact that the vulnerability requires local authorization means the attack is likely limited to authenticated users or those with administrative rights. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation at the time of this analysis. Nonetheless, the potential for privilege escalation warrants immediate attention and remediation.