Windows Bluetooth Service CVE-2026-58538

Exploitation requires the attacker to already have authenticated local access to the Windows host with at least low privileges (CVSS PR:L), and the target must have the Windows Bluetooth Service present and running - the practical prerequisite is that the Bluetooth stack is enabled/reachable by a local caller, which is default on Windows client SKUs but frequently disabled or absent on servers. No user interaction is required (UI:N) and no special non-default configuration beyond an active Bluetooth Service is indicated by the data. Limiting factors: the attack is local only (AV:L, not remotely reachable over a network), it needs a pre-existing low-privilege foothold, and hosts with Bluetooth disabled or no Bluetooth hardware substantially reduce exposure.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8, High) describes a locally exploitable issue with low attack complexity, requiring low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact within an unchanged scope - consistent with a low-to-SYSTEM elevation of privilege. No EPSS score was provided in the input, so exploitation-probability cannot be quantified here. It is not listed in CISA KEV and no POC is referenced, so this is not confirmed to be under active exploitation. The realistic priority is moderate-to-elevated: it is not a remote or wormable bug (AV:L requires the attacker to already have a foothold), but EoP flaws in ubiquitous default components like Bluetooth are common post-compromise pivots and Patch-Tuesday-class fixes, so it warrants prompt patching in standard cycles rather than emergency response. No signals conflict; the main missing data are EPSS and any confirmation of exploit availability.

An attacker who has already gained low-privileged code execution on a Windows host (for example through phishing or a compromised low-rights service account) invokes the local Bluetooth Service with crafted input that overflows a heap buffer, corrupting service memory to execute code as SYSTEM. Given AV:L/AC:L, no user interaction is needed and the technique is reliable once a foothold exists. No public POC is referenced, so an attacker would need to develop the exploit or await one.