The vulnerability is an integer overflow or wraparound flaw in Windows Background Intelligent Transfer Service (BITS). This flaw allows an attacker who is already authenticated on the local system to manipulate BITS internal calculations, thereby gaining elevated privileges. The consequence is that a low‑privilege user can achieve higher privileges, potentially including local administrator rights, which can then be leveraged to compromise additional system components.

Affected systems include multiple Microsoft Windows editions. Desktop releases span Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2. Server releases include Windows Server 2012 (full and Server Core), Windows Server 2012 R2 (full and Server Core), Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No specific sub‑version or update levels are listed.

The CVSS score of 7.8 classifies this flaw as a High‑severity issue, indicating that exploitation could lead to a significant compromise. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting no public evidence of exploitation at the time of reporting. Likely attack vector is local, requiring authenticated access; the attacker needs no network exposure but must have some level of access to the target machine.