Windows Bluetooth Driver CVE-2026-68849

Exploitation requires an authenticated local account with at minimum standard user (low) privileges on the target system (PR:L confirmed by CVSS vector). High attack complexity (AC:H) indicates specific conditions must be met to trigger the out-of-bounds read - likely a particular Bluetooth hardware state, I/O sequence timing, or device enumeration race condition; the exact trigger is not disclosed in available sources. Exploitation is strictly local (AV:L) - no network-reachable path exists and no user interaction beyond meeting the complexity condition is required (UI:N). Limiting factors: the attacker must have local interactive or remote desktop logon access; Bluetooth hardware must be present and the Bluetooth Port Driver loaded; AC:H makes reliable exploitation non-trivial without detailed knowledge of the trigger; no scope change (S:U) means the impact is confined to the vulnerable component's privilege boundary.

The CVSS 3.1 base score of 4.7 (Medium) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a substantially constrained threat: exploitation is local-only with no network attack path, requires low-privileged authentication, and imposes high attack complexity - likely a specific race condition or Bluetooth device state requirement. Confidentiality impact is rated High (C:H), meaning successful exploitation can yield sensitive kernel memory disclosure, but there is no integrity or availability impact, ruling out direct code execution from this vulnerability alone. No EPSS score was provided in the input data; in the absence of KEV listing or public exploit code, real-world exploitation probability appears low for opportunistic attackers but non-negligible as a post-compromise information-gathering primitive. The 'Buffer Overflow' tag in source metadata is a mislabel - CWE-125 is an out-of-bounds read (not a write), so there is no memory corruption or arbitrary code execution vector directly from this CVE. Defenders should treat this as a kernel memory leak facilitating privilege escalation chains rather than a standalone high-severity threat.

A low-privileged local user or an attacker with an established foothold interacts with the Windows Bluetooth Port Driver under specific conditions - likely a particular device enumeration state or I/O timing window - triggering the out-of-bounds read in bthport.sys. The kernel-mode OOB read returns controlled-sized kernel memory to user space, potentially leaking pointer values useful for ASLR bypass or sensitive data for use in a follow-on privilege escalation chain. No public exploit code is known at time of analysis, meaning reliable exploitation likely requires non-trivial reverse engineering of bthport.sys to identify the exact trigger.