Windows BITS CVE-2026-85848

Exploitation requires the attacker to already have authenticated local access to the target host with at least low-level user privileges (PR:L) and the ability to run code or submit input to the BITS service, which is enabled by default on all supported Windows versions. No user interaction is required (UI:N) and no non-default configuration is needed since BITS is a standard built-in service. The primary limiting factor is the local attack vector (AV:L): the attacker cannot exploit this remotely and must first obtain a foothold on the system, making this a privilege-escalation step rather than an entry point. Affected builds span Windows 10 (1607-22H2), Windows 11 (23H2-26H2), and Windows Server 2012 through 2025; systems patched to the fixed build numbers listed in the EUVD record are not exploitable.

This is a moderately high-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) confirms a local attack vector requiring low privileges and no user interaction, with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with a heap-based buffer overflow (CWE-122) yielding SYSTEM-level code execution. The 7.8 score is driven by impact, not reachability: an attacker must already have authenticated local access, so this is a post-compromise escalation primitive rather than an initial-access or remotely-wormable flaw. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis; the absence of these signals suggests it is not currently part of widespread automated exploitation. However, BITS EoP bugs are historically attractive to attackers for the second stage of an intrusion, and the vulnerability affects nearly the entire supported Windows fleet, so it warrants prompt patch prioritization despite the low attack vector. No signals conflict: CVSS, the description ('elevate privileges locally'), and the CWE all consistently describe a local, authenticated heap overflow.

An attacker who has already gained an unprivileged foothold on a Windows host (e.g., via phishing or a compromised low-privilege account) runs a crafted local program that sends malformed data to the Background Intelligent Transfer Service, overflowing a heap buffer to corrupt memory and execute code in the service's privileged context, escalating to SYSTEM. No user interaction is required and no public exploit code is identified at time of analysis, but exploitation would require local code execution as a prerequisite.