The reported vulnerability is a use‑after‑free condition in the Background Intelligent Transfer Service (BITS) on Microsoft Windows. This flaw permits an attacker to trigger an uncontrolled memory access that can be leveraged to execute arbitrary code within the context of the BITS service, potentially elevating privileges. The flaw is listed as CWE‑122 and has a CVSS base score of 8.8, indicating high severity.

Affected customers include Microsoft Windows 10 from build 1607 to 22H2 and Windows 11 from build 23H2 to 26H2 (including 26H1) as well as all editions of Windows Server ranging from 2012 to 2025 and their Server Core installations. Users of these operating systems should check whether they have applied the cumulative update that addresses the BITS use‑after‑free issue.

The exploit is likely to be delivered over the network through a crafted BITS transfer request, meaning that an external attacker that can reach a vulnerable host may trigger the vulnerability. The lack of an EPSS score means the historical probability of exploitation is unknown, but the high CVSS and absence of KEV listing suggest that the vulnerability is not actively exploited in the wild yet. Nonetheless, the impact of successful exploitation is remote code execution with potential privilege escalation.