Windows BITS EUVD-2026-100097

Exploitation requires the attacker to already have local, authenticated low-privilege code execution on the target Windows host (AV:L, PR:L) - there is no remote or network-reachable path and no user interaction by a victim is needed (UI:N). The attacker must reach and trigger the vulnerable code path in the Background Intelligent Transfer Service, a service present by default on all supported Windows client and server editions, so no non-default configuration is required. The principal limiting factor is the prerequisite foothold: this is a post-access privilege-escalation primitive, not an initial-access vector, which substantially narrows realistic exploitation to environments where an attacker or malware is already running as a standard user. Patched builds are enumerated per Windows version (e.g., Windows 11 24H2 fixed in 10.0.26100.9711, Server 2022 in 10.0.20348.5761), so only pre-patch builds are exploitable.

This is a genuine patch-priority item but not an emergency. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw: the attacker must already be able to run code on the host as a low-privileged authorized user (PR:L, AV:L), after which a use-after-free (CWE-416) in BITS yields high confidentiality, integrity, and availability impact (total compromise of the local system). CISA's SSVC framework aligns with a measured posture: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be mass/wormable because it needs local prior access), and Technical Impact=total (consistent with C:H/I:H/A:H). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no POC indicator - no public exploit identified at time of analysis. The signals are therefore consistent with one another rather than conflicting: high local impact but a meaningful access precondition and no evidence of exploitation. As a Microsoft-patched BITS LPE it is the classic post-compromise privilege-escalation primitive attackers chain after initial access, so it should be prioritized in normal Patch Tuesday cadence for all Windows estates, but it does not warrant out-of-band emergency response on exploitation grounds alone.

A low-privileged user (or malware already running in a standard user context after phishing or a separate initial-access bug) invokes the vulnerable BITS code path to trigger the use-after-free, corrupting memory to hijack execution in the privileged BITS service and gain SYSTEM-level privileges. Because the vector is local and requires existing authenticated access (AV:L/PR:L), it functions as a second-stage escalation rather than a remote entry point. No public exploit identified at time of analysis, so weaponization effort would currently fall on the attacker.