The vulnerability is a use‑after‑free in the Background Intelligent Transfer Service (BITS) that allows an unauthorized attacker to execute code on the target machine when data is transferred over the network. The flaw is a classic memory‑safety bug, reflected by the CWEs cited. Successful exploitation would give the attacker arbitrary code execution, compromising the confidentiality, integrity, and availability of the affected Windows system.

Microsoft Windows 10 from Version 1607 to 1809, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025 – including Server Core installations. Each of these builds contains the vulnerable BITS implementation; no specific patch version information is included in the CNA data.

The CVSS score of 8.1 indicates a high severity risk. The EPSS score is not available, so the current likelihood of exploitation cannot be quantified, but the vulnerability is publicly listed and is not part of CISA’s KEV catalog. The attack vector is remote via the network; an authenticated or unauthenticated attacker who can send a crafted request to BITS can trigger the use‑after‑free, leading to arbitrary code execution.