EUVD-2026-35682
GHSA-7875-jr7x-qfvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryOpen handle to Bluetooth Service IPC
-
ExploitTrigger use-after-free in bthserv
-
ExecutionReclaim freed object with controlled data
-
PersistHijack execution as SYSTEM
-
ImpactDisable defenses and persist
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local code execution on the target Windows host as an authenticated low-privileged user (CVSS PR:L) able to reach the Bluetooth Service's local IPC interfaces, and the Bluetooth Support Service (bthserv) must be running on the host - which is the default on most Windows client SKUs but is often disabled on Windows Server and on hardened endpoints without Bluetooth radios. No user interaction by another principal is required (UI:N), the attack is purely local (AV:L) so network-only adversaries cannot reach it, and scope is unchanged (S:U) so impact is bounded to the local host. Hosts where bthserv is disabled, removed, or blocked by policy are not exploitable. |
| Impact | The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms local attack vector with low complexity and low-privilege authenticated access, with no scope change but high CIA impact - typical of a SYSTEM-level EoP. There is no EPSS, KEV, or SSVC data in the provided inputs, and no POC is referenced, so exploitation is best characterized as 'no public exploit identified at time of analysis.' For prioritization, this is a meaningful but not emergency-level issue on multi-user endpoints, terminal/RDP hosts, and shared workstations where a low-privileged user could chain it for SYSTEM; on single-user, fully patched developer laptops the practical risk is lower. Notably, the tag set includes 'Denial Of Service' alongside 'Use After Free / Memory Corruption,' which is consistent with CVSS A:H and suggests reliable crashes may precede reliable code-execution exploitation. |
| Exploit ScenarioDerived | A low-privileged user who has obtained an interactive or remote session on a Windows host (for example via phishing, an RDP foothold, or a kiosk account) issues crafted IPC requests to the Bluetooth Service to trigger the use-after-free, sprays the heap to control the reclaimed allocation, and pivots execution to gain SYSTEM. From SYSTEM the attacker disables endpoint protection, harvests credentials from LSASS, and moves laterally. No public exploit is identified at time of analysis, but the bug class is well-understood and historically weaponizable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Local privilege escalation in the Windows Bluetooth Service stems from a use-after-free condition (CWE-416) that an authenticated low-privilege user can trigger to gain elevated rights on the host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects a fully local attack with high impact across confidentiality, integrity, and availability, and no public exploit has been identified at time of analysis. The flaw was reported by Microsoft (secure@microsoft.com) and tracked in the MSRC update guide.
RemediationAI
Apply the Microsoft security update referenced on the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45605 for each affected Windows edition and build - exact fixed build numbers are published per-SKU in that advisory and should be cited as the patch of record. As a compensating control on hosts where patching must be delayed, disable the Bluetooth Support Service (bthserv) via 'sc config bthserv start= disabled' and stop the service, which removes the vulnerable attack surface but breaks all Bluetooth peripheral functionality (keyboards, mice, audio, file transfer). On endpoints that do not require Bluetooth, disable the radio at the hardware/UEFI level or via Group Policy ('Allow Bluetooth' set to Disabled) to prevent the service from being reactivated; restricting interactive and remote logon (e.g., RDP) to trusted users on shared hosts further reduces the population of attackers able to call the local interface.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 27 packages in microsoft, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Windows Bluetooth Service (bthserv) is a system-level Windows component responsible for managing Bluetooth radios, pairing, and protocol stack interactions; it typically runs with SYSTEM-level privileges and exposes IPC surfaces (RPC/COM/IOCTL) to lower-privileged callers. CWE-416 (Use After Free) indicates the service references a heap object after it has been deallocated, allowing the freed memory to be re-allocated and controlled by the attacker before the dangling pointer is dereferenced. Because the service operates in a higher trust boundary than the caller, controlling the freed object's contents can corrupt function pointers or vtables and pivot execution into attacker-supplied data, resulting in arbitrary code execution in the service's context.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A local privilege escalation vulnerability in the Windows Bluetooth Service (CVE-2026-45605) allows authenticated users to elevate to system-level rights, enabling complete compromise of affected systems. Organizations operating Windows infrastructure with Bluetooth enabled face immediate risk of unauthorized access, data theft, and operational disruption, as any logged-in user can exploit this flaw to bypass security controls and access sensitive resources.
No vendor-released patch identified at time of analysis. Interim mitigations: Disable Windows Bluetooth Service on non-essential systems; enforce Group Policy device installation restrictions for Bluetooth devices; implement application whitelisting to prevent use-after-free exploitation; audit and strengthen local user account privileges; enable security event logging for Bluetooth Service and privilege escalation attempts; isolate affected systems on network segments with restricted lateral movement.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB