The vulnerability is a use‑after‑free bug in the Windows Background Intelligent Transfer Service that allows an attacker to execute arbitrary code on a host. Triggered by a crafted network request, it does not require local privileges. Successful exploitation gives the attacker full system control, enabling back‑door installation, data theft or lateral movement.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including core installations).

The CVSS score of 8 indicates high severity. EPSS data is unavailable, so the exploit probability cannot be quantified, but the flaw can be reached from any network with access to the BITS service. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed large‑scale attacks yet. The likely attack vector is a remote network attacker sending a malicious request to the BITS endpoint to trigger the use‑after‑free and gain code execution.