Windows BITS EUVD-2026-100101

Exploitation targets the Windows Background Intelligent Transfer Service (BITS), a default-enabled core component of all supported Windows client and server editions, so no special feature toggle is required. The key limiting factor is the CVSS PR:L metric: the attacker must already hold low-level privileges (an authenticated/low-privileged context) rather than being fully unauthenticated, which raises the bar versus a pure drive-by RCE. No user interaction is required (UI:N) and attack complexity is low (AC:L). CISA SSVC marks Automatable:no, indicating exploitation is not readily scriptable for mass/wormable use. Patching to the fixed build (e.g. Windows 11 24H2 ≥10.0.26100.9711, Server 2025 ≥10.0.26100.33650, Server 2019 ≥10.0.17763.9376, per the EUVD version data) removes the condition.

This is a genuinely high-priority patching target, though signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity, no-user-interaction flaw requiring only low privileges, with total CIA impact (C:H/I:H/A:H) - consistent with the 8.8 base score and remote code execution in a core OS component. CISA's SSVC framework tempers this: Exploitation is rated 'none' (no observed attacks) and Automatable is 'no' (not trivially wormable at scale), while Technical Impact is 'total' - aligning with the full-compromise CIA metrics. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided, so real-world exploitation likelihood cannot be quantified from the input. The practical conclusion: a critical-impact, network RCE in a component present on virtually every Windows system, but currently without evidence of active exploitation and gated by a low-privilege prerequisite (PR:L) - prioritize patching broadly given the enormous install base, while noting exploitation is not yet observed. One data note: CWE-122 (heap-based buffer overflow) in the input conflicts with the description's 'use after free' (normally CWE-416) - verify the precise memory-corruption primitive with the vendor.

An attacker with low-privileged access to a Windows host (or to a network position able to reach the BITS service as an authenticated principal) sends crafted data to the Background Intelligent Transfer Service, triggering a use-after-free in the transfer handling. Successful exploitation corrupts heap memory to achieve arbitrary code execution, escalating control of the affected system. No public exploit code has been identified, and CISA's SSVC rates exploitation as 'none', so this is currently a theoretical rather than observed attack chain.