Windows BITS: Remote code execution via use-after-free

Summary

The Windows Background Intelligent Transfer Service (BITS) contains a use-after-free weakness that allows code execution over the network. The CNA record describes an unauthorized attacker, while the CVSS vector requires low privileges; the CWE is still unresolved (CWE-122 in the request, CWE-416 use-after-free in the CNA description). Many Windows 10, Windows 11 and Windows Server branches are affected, including Windows 10 1607 and Windows Server 2016. No exploitation or public proof of concept is known.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 (including Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (including Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Fixed builds per CNA record: first build outside each affected range, as listed above.
• Windows 10 1607 and Windows Server 2016: build 14393.9612 (October 2026 update, KB5126868; from the release-health page, not verified on MSRC).
• Windows 10 Enterprise LTSB 2016 (1607) no longer receives updates since 13 October 2026. It is only covered if enrolled in ESU; ESU coverage of this CVE is unconfirmed.

Workaround

• No vendor workaround found.
• Isolate unsupported 1607 devices from untrusted networks.
• Where business use allows, restrict or disable BITS on affected systems. Test first; this is not vendor guidance.

Exploitation

• No exploitation in the wild known.
• No public proof of concept found.
• CISA SSVC: Exploitation none, not automatable, total technical impact.
• EPSS below 1 percent (secondary source).

Our recommendation

• Inventory all Windows 10 1607 and Windows Server 2012, 2012 R2 and 2016 systems, especially fixed-function devices.
• Install the October 2026 cumulative updates on supported systems as a planned patch.
• For 1607 LTSB devices: enrol in ESU if eligible; otherwise isolate them and plan migration to Windows 11 Enterprise LTSC 2024.
• Monitor event logs and EDR for anomalous BITS activity.
• Verify fixed builds and the final CWE on the MSRC page and in NVD.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88142 msrc.microsoft.com
• Microsoft release health: Windows 10 1607 and Windows Server 2016 learn.microsoft.com
• 4sysops: Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
• OpenCVE: CVE-2026-88142 app.opencve.io
• Vulners: CVELIST CVE-2026-88142 vulners.com
• Strix: CVE-2026-88142 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:11.