Windows BITS EUVD-2026-99549

Requires the attacker to already have authenticated local code execution as a low-privileged user (PR:L, AV:L) on a vulnerable Windows system; the Background Intelligent Transfer Service (BITS) is enabled by default on all Windows editions, so no non-default feature or configuration is needed to reach the vulnerable code. Exploitation is limited to local scenarios - it cannot be triggered remotely or across a network, and it is not reachable by an unauthenticated attacker - which bounds its use to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable elevation-of-privilege flaw in Windows BITS (CWE-908, use of uninitialized resource) with a vendor-assigned CVSS of 7.8. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms the attacker must already be local and authenticated (PR:L) but faces low complexity and needs no user interaction, with high confidentiality, integrity and availability impact on an unchanged scope (S:U). No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' The practical risk is that of a reliable local privilege-escalation primitive: not remotely wormable, but highly valuable in post-compromise chains because it affects a default, always-present Windows component across virtually every supported Windows release. Signals are internally consistent (local vector matches a local EoP description); the main caveat is the 'Information Disclosure' tag, which conflicts with the EoP description and the C/I/A:H profile - treat the tag as suspect rather than the CVSS. Priority is moderate-to-high for managed enterprise fleets given ubiquity and a low-complexity local vector, but it is not an internet-facing emergency on its own.

An attacker who already has a low-privileged foothold on a Windows host (e.g., via phishing or a compromised standard user account) runs a crafted local program that triggers BITS to use an uninitialized resource, corrupting state in a privileged context. By controlling the uninitialized data, the attacker escalates from the standard user to SYSTEM. No public exploit code is identified at time of analysis, and low attack complexity (AC:L) suggests a reliable primitive once developed.