The vulnerability is a use‑after‑free bug in Windows Background Intelligent Transfer Service (BITS) that allows an unauthorized attacker to execute arbitrary code on a target system over a network. By sending specially crafted BITS job requests the attacker can trigger memory corruption, potentially gaining full system compromise with SYSTEM privileges. The flaw is a classic example of CWE‑125, where out‑of‑bounds memory access is exploited for remote code execution.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2 (duplicate); Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their server core installations. All listed editions are vulnerable.

The CVSS score of 8.8 indicates a high severity with potential for widespread impact. The EPSS score is 1%, indicating a low but non-zero exploitation probability, and the lack of a KEV listing does not diminish the urgency, as remote exploitation can be carried out from the network by targeting the BITS service. Attackers would need network‑level access to the victim machine and would craft malicious BITS job data to trigger the use‑after‑free condition, leading to arbitrary code execution. No publicly disclosed exploits are available yet, but the high CVSS and proven remote execution vector warrant immediate attention.