A use‑after‑free defect in the Windows Background Intelligent Transfer Service (BITS) allows a local attacker with authorised significance to elevate privileges. The flaw is a classic memory-safety issue, specifically a use‑after‑free (CWE‑416). Once triggered, an attacker can execute arbitrary code under the context of the BITS service, effectively expanding their privileges on the affected system. This elevation can enable the compromise of system integrity and confidentiality without requiring initial full control.

Affected Windows releases include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 again, 26H1; and Windows Server releases from 2012, 2012 R2, 2016, 2019, 2022, and 2025, across both standard and server‑core installations.

The CVSS score of 7.8 indicates a high risk potential, while no EPSS data is presently available and the issue is not listed in the CISA KEV catalog. The attack vector is local, requiring the attacker to have legitimate access or be able to run code with the rights of a BITS operation. The use‑after‑free nature of the vulnerability typically demands a specific sequence of interacting with the BITS service, but once exercised it can lead to unchecked code execution and privilege escalation. Given its severity and the lack of broader exploitation data, the potential for widespread intrusion remains cautionary but real for any machine running the affected Windows builds.