Windows BITS: Heap-based buffer overflow leads to local privilege escalation

Summary

A heap-based buffer overflow in the Windows Background Intelligent Transfer Service (BITS) allows an authorized local attacker to elevate privileges. The attacker needs local access and an existing low-privilege account; the flaw is not reachable over the network. Microsoft rates it Important (CVSS 3.1 base score 7.8) and a patch is available.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to below 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to below 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to below 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to below 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to below 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to below 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to below 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to below 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to below 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (6.2.9200.0 to below 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to below 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 to below 10.0.14393.9612)

Fixed in

• Install the October 2026 security update for each affected edition.
• Minimum fixed builds per the CVE record: 10.0.14393.9612 (1607, Server 2016); 10.0.17763.9376 (1809); 10.0.19044.7807 (21H2); 10.0.19045.7807 (22H2); 10.0.22631.7652 (23H2); 10.0.26100.9711 (24H2); 10.0.26200.9711 (25H2); 10.0.28000.3231 (26H1); 10.0.26300.9711 (26H2); 6.2.9200.26434 (Server 2012); 6.3.9600.23470 (Server 2012 R2).
• KB numbers for Windows 10 1607: Unknown. Check the MSRC page.

Workaround

Unknown. No vendor workaround was identified; the update is the fix.

• Interim measure (own recommendation, not vendor guidance): limit interactive local logons on affected hosts and remove unneeded local accounts.

Exploitation

• CISA SSVC data lists exploitation as none and automatable as no.
• Microsoft's temporal vector uses exploit code maturity E:U (unproven).
• No public proof of concept found in the research. This is absence of evidence, not confirmation.
• Not listed in the CISA KEV catalog according to OpenCVE (not independently verified).

Our recommendation

• Patch multi-user systems, terminal/RDS servers and shared workstations first with the October 2026 cumulative update.
• Patch single-user managed laptops in the normal cycle; local privilege escalation is often chained after phishing or malware.
• Limit local logons and privileged accounts on affected hosts.
• Windows 10 1607 is an older build: verify whether it is still serviced and plan a migration if it is still in use.
• Monitor for unusual BITS activity and new local administrator accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-85832 msrc.microsoft.com
• Talos: Microsoft Patch Tuesday for October 2026 blog.talosintelligence.com
• Vulners NVD record CVE-2026-85832 vulners.com
• Vulners mscve version table CVE-2026-85832 vulners.com
• OpenCVE CVE-2026-85832 app.opencve.io
• VulDB entry 419248 vuldb.com
• Strix CVE-2026-85832 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:05.