Windows AVCTP CVE-2026-69401

Exploitation requires an authenticated local user account with at least low-privilege access to the target system - remote unauthenticated exploitation is not applicable given AV:L/PR:L. The Bluetooth Support Service (bthserv) and the AVCTP driver must be active and accessible to the attacking process; systems with Bluetooth hardware disabled in firmware/BIOS or with Bluetooth services stopped would limit exposure. High attack complexity (AC:H) indicates a race condition or specific kernel heap state must be established, requiring a capable attacker rather than a script-kiddie using a generic tool. Affected only on Windows 11 versions 24H2, 25H2, 26H1 and Windows Server 2025; older Windows releases (10, Server 2022, etc.) are not listed as affected.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.0, accurately reflecting a local, low-privileged, high-complexity attack. The high attack complexity (AC:H) is the primary risk-limiting factor, indicating the exploit likely requires precise race-condition timing or specific kernel object state that cannot be reliably triggered on the first attempt. The low privilege requirement (PR:L) means any standard domain or local user account suffices as a launchpad. Real-world risk is therefore moderate-to-high in multi-user or terminal-server environments where untrusted local users exist (e.g., shared developer workstations, RDS hosts, VDI). On single-user consumer endpoints, an attacker would first need code execution as a standard user before exploiting this issue. No public exploit or KEV listing was identified at time of analysis, meaning opportunistic exploitation is not currently observed. The combination of AC:H and no public POC meaningfully lowers the immediate exploitation probability, but Windows' ubiquitous deployment ensures a large target population even for targeted use.

A low-privileged user already logged on to an unpatched Windows 11 or Server 2025 host opens a Bluetooth AVCTP connection or interacts with the AVCTP driver in a manner that triggers a race condition on a kernel object, causing a use-after-free. By carefully grooming the kernel heap beforehand and timing the free-and-reuse sequence, the attacker corrupts a kernel structure, gains arbitrary kernel read/write, and escalates their process token to SYSTEM. No public exploit code exists at time of analysis, but the technique is well-understood in Windows kernel exploitation research.