CVE-2026-88142: CWE-122: Heap-based Buffer Overflow in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-88142) involves a use-after-free condition in the Windows Background Intelligent Transfer Service (BITS) component of Microsoft Windows 10. Exploitation of this heap-based buffer overflow could allow an attacker to execute arbitrary code remotely with limited privileges. The vulnerability affects multiple Windows 10 builds starting from version 1607 and later, up to specific patched builds. Microsoft has published an official fix to address this issue.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The CVSS v3.1 base score is 8.8 (high severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft as detailed in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88142 to remediate this vulnerability.