{"id":"CVE-2026-88159","published":"2026-10-13T19:21:36.207","lastModified":"2026-10-16T16:22:37.243","description":"Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-125"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88159","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Windows BITS allows remote attackers to execute arbitrary code on affected systems. This flaw occurs when the service processes data after memory has been freed, potentially leading to privilege escalation or system compromise.","exploitability":"Exploitation requires a network-based attack with local user privileges, making it moderately difficult but feasible for attackers who can establish a connection to the BITS service.","blast_radius":"If exploited, this vulnerability could allow attackers to execute code remotely on Windows systems with BITS enabled, potentially leading to full system compromise across enterprise networks.","remediation":"Apply the Windows update KB5049738 or later to fix the BITS use-after-free vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","windows","bits","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:05:10.828Z"}}