EUVD-2026-99541
GHSA-89g8-gh7m-wjvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local foothold
-
DeliveryCraft malicious BITS job/input
-
ExploitTrigger heap buffer overflow in BITS
-
ExecutionHijack SYSTEM-context execution
-
ImpactFull privilege escalation to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have authenticated, low-privileged local code-execution on the target Windows host (CVSS PR:L, AV:L) and the ability to interact with the Background Intelligent Transfer Service (BITS), which is present and running by default across all supported Windows client and server editions. No user interaction (UI:N) and no network vector are needed. The principal limiting factor is the need for an initial local foothold - this is a second-stage privilege-escalation bug, not a standalone remote entry point - which means it is most relevant as part of a post-compromise chain rather than for initial access. |
| Impact | This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a local privilege-escalation flaw requiring an already-authenticated low-privileged foothold on the host - it is not remotely exploitable, which caps the raw CVSS at 7.8 (High) despite full C:H/I:H/A:H impact (SYSTEM-level compromise via the BITS service). No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public POC is referenced, so there is no evidence of active exploitation or weaponization at this time. CWE-122 (heap-based buffer overflow) in a SYSTEM-level Windows service is a classic and historically reliable local EoP primitive, so exploit development is plausible once details circulate, but today the signals are consistent: a serious-if-chained local EoP with no observed in-the-wild activity. Patch availability from Microsoft is the decisive risk-reducer. Note: no SSVC decision or EPSS value was provided in the input, so automatability and exploitation-maturity cannot be scored from the data given. |
| Exploit ScenarioDerived | An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised user account, or a separate RCE) invokes the Background Intelligent Transfer Service with crafted input that overflows a heap buffer in BITS, corrupting memory to hijack execution within the SYSTEM-level service and gain full privilege escalation. No user interaction and no network access are required, but an initial authenticated foothold is a prerequisite. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in Windows Background Intelligent Transfer Service (BITS) allows an authenticated attacker with low-privileged local code execution to trigger a heap-based buffer overflow and potentially gain SYSTEM-level privileges. Affected systems span Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025; exploitation requires an existing local foothold (CVSS 3.1 AV:L/PR:L/UI:N, 7.8 High) and no user interaction. No public exploit was identified at time of analysis, and Microsoft has released patches, making this a credible post-compromise escalation chain component rather than a standalone remote entry point.
RemediationAI
Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-85832 to bring affected systems to or above the fixed builds listed in the affected-products data (for example, Windows 11 24H2 to 10.0.26100.9711 or later, Windows Server 2022 to 10.0.20348.5761 or later). Because this is a local privilege-escalation issue, patch deployment should be prioritized for multi-user systems and servers where untrusted users already have local logon or code-execution rights. If immediate patching is not possible, restrict local interactive logon and code-execution privileges to trusted users, and monitor BITS job creation and service-related event logs for anomalous activity; disabling or heavily restricting the BITS service is an option but will break Windows Update, WSUS, SCCM, and many enterprise application update mechanisms, so it should only be considered as a temporary, high-impact compensating control. No public exploit was identified at time of analysis, but the available patch should be treated as the primary fix per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85832.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BITS is a Windows service that transfers files in the background using idle network bandwidth and is exposed through COM interfaces that local processes can invoke. CVE-2026-85832 is a heap-based buffer overflow (CWE-122) within BITS, meaning crafted input causes a write beyond the bounds of a heap-allocated buffer, corrupting adjacent memory and potentially enabling controlled code execution in the context of the BITS service. Because BITS typically runs as SYSTEM, a successful exploit elevates a low-privileged local user to SYSTEM. The assessed CVSS vector (AV:L, AC:L, PR:L, UI:N, S:U, C:H/I:H/A:H) confirms that the attacker must already have authenticated local code execution and interact with BITS locally; there is no network or user-interaction vector. This makes the flaw primarily useful in post-exploitation privilege escalation rather than for initial access.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only heap overflow needing an authenticated low-priv foothold (AV:L, PR:L), reliably triggerable (AC:L), yielding SYSTEM-level full C/I/A impact with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation vulnerability in Windows Background Intelligent Transfer Service (BITS) affects Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. An authenticated attacker with an existing local foothold could exploit it to gain SYSTEM-level privileges, creating a significant post-compromise risk for endpoints and servers. No public exploit identified at time of analysis, and Microsoft has released a patch; leadership should prioritize remediation to prevent escalation and lateral movement.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Exploit-DB