CVE-2026-88118

7.8High

Published 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-122, CWE-190

Impact

A local attacker with standard user access can elevate privileges to SYSTEM on the affected Windows machine. They need existing local execution or valid credentials on the target host.

Root cause

An integer overflow or wraparound condition in the Windows Background Intelligent Transfer Service (BITS) leads to a heap-based buffer overflow.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Install the Microsoft security update for Windows BITS from the MSRC advisory; if immediate patching is impossible, disable the Background Intelligent Transfer Service (BITS) via the Services console or PowerShell as an interim mitigation.

shell

$ Stop-Service -Name BITS -PassThru | Set-Service -StartupType Disabled

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88118

Source: nvd.nist.gov/vuln/detail/CVE-2026-88118