Windows Bluetooth Driver CVE-2026-42975

Exploitation requires that the target system has Bluetooth enabled and an active/reachable Bluetooth Port Driver, and that the attacker is within Bluetooth radio range (CVSS AV:A / adjacent network) - internet-based remote exploitation is not supported by the data. Per the CVSS vector (PR:N/UI:N/AC:L), no authentication and no user interaction are required and complexity is low, so against a Bluetooth-enabled default configuration an in-range attacker can trigger the overflow directly. The primary limiting factors are the physical-proximity requirement (which prevents remote or automatable mass exploitation, matching SSVC Automatable:no) and the need for Bluetooth to be active - systems with Bluetooth disabled or no adapter (typical on many servers) are not exploitable.

Signals here are mixed but lean toward prompt patching. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N) describes low-complexity, unauthenticated exploitation requiring only adjacency, and the impact is total system compromise (C:H/I:H/A:H, kernel-mode). Counterbalancing this: EPSS is low at 0.38% (30th percentile), CISA SSVC lists Exploitation as 'none' and Automatable as 'no', and no public exploit has been identified - consistent with the fact that Bluetooth attacks are not internet-scannable and require physical proximity, which structurally limits mass exploitation (hence Automatable:no). This is best read as a genuinely serious flaw whose real-world exploitation is constrained by the adjacency requirement rather than a low-risk high-CVSS artifact. Note a nuance: the CVSS vector uses AV:A (adjacent, meaning same physical Bluetooth range), not AV:N (network), so remote-over-internet exploitation is not indicated by the data - the attacker must be within radio range.

An attacker within Bluetooth radio range of a vulnerable Windows machine sends specially crafted Bluetooth frames that overflow a heap buffer in the Bluetooth Port Driver, corrupting kernel pool memory to achieve arbitrary code execution as SYSTEM. No user interaction or authentication is required, so a target with Bluetooth enabled in a public space (conference, office, café) could be compromised silently. No public proof-of-concept has been identified at time of analysis, and the adjacency requirement means the attacker must be physically nearby.