A race condition occurs when multiple BITS processes access a shared resource without proper synchronization, allowing an authorized local user to manipulate execution order and elevate privileges. The vulnerability is described by CWE-362 (Race Condition) and CWE-416 (Use After Free), which together can cause the system to execute code with higher privileges than originally granted. Successful exploitation could give the attacker local administrative rights and the ability to install malware or modify system configuration.

The flaw affects Microsoft Windows operating systems including Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server releases 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7 indicates a high severity, and although EPSS data is unavailable and the flaw is not currently listed in CISA’s KEV catalog, the attack vector is local and requires only a user that can trigger BITS operations. An attacker with local privileges can exploit the race condition to gain administrator rights, potentially leading to full system compromise. The vulnerability is most easily mitigated by applying the vendor’s patch; if unavailable, preventing BITS from running offers a temporary safeguard.