Windows Bluetooth Service CVE-2026-69388

Exploitation requires a locally authenticated user account (PR:L) on the target Windows system - the description uses 'authorized attacker,' consistent with any standard domain or local user credential. The Bluetooth Service (bthserv) must be running and Bluetooth hardware must be present or emulated; the service is enabled by default on consumer Windows 10/11 editions but may be disabled on headless server deployments or systems without Bluetooth adapters. The AC:H rating indicates a race condition or specific heap-state requirement must be satisfied, meaning exploitation is not straightforwardly reliable and likely requires multiple attempts or precise timing. There is no network-facing component - the attack is entirely local. Exploitation is limited by: the need for an existing low-privileged local session, Bluetooth service being active, and the high-complexity timing requirement that reduces reliability.

The CVSS base score of 7.0 reflects a meaningful local escalation risk: while AV:L and AC:H significantly limit the attack surface compared to network-exploitable flaws, the C:H/I:H/A:H triad means successful exploitation yields full system control. EPSS data is not available in the provided input, and this CVE is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at time of writing. No public proof-of-concept has been identified. The practical risk is highest in shared-access environments - multi-user workstations, VDI deployments, and terminal servers - where a low-privileged user can interact with the Bluetooth subsystem; even a mid-sized municipal IT team in leszno managing shared Windows 11 endpoints should treat this as a standard Patch Tuesday priority rather than a critical emergency, given the complexity requirement. SSVC assessment: exploitation is not yet automated or publicly demonstrated; technical impact is total if exploitation succeeds; this warrants scheduled patching within the normal patch cycle rather than emergency out-of-band action, absent evidence of targeted exploitation.

A low-privileged user logged into a shared Windows workstation or terminal server triggers a race condition in the Windows Bluetooth Service - for example by rapidly initiating and aborting Bluetooth device pairing operations - causing a use-after-free that allows controlled heap data to be placed in the freed region. The attacker's shellcode or ROP chain executes in the Bluetooth service context, which runs at elevated privilege, achieving SYSTEM-level access on the local machine. No public exploit code has been identified at time of analysis, and the AC:H rating indicates reliable exploitation requires non-trivial timing precision.