Windows Bluetooth Port Driver CVE-2026-69817

Exploitation requires an authenticated local session with at least low-privilege access (PR:L) - a standard interactive or remote desktop user account is sufficient. The Bluetooth Port Driver (bthport.sys) must be loaded, which requires Bluetooth hardware to be present or a Bluetooth adapter to be attached; systems without any Bluetooth hardware or with Bluetooth disabled in firmware/Device Manager are not affected by the driver-level attack surface. High attack complexity (AC:H) indicates successful exploitation requires precise memory manipulation timing, limiting exploitation to technically sophisticated attackers. No network-facing exposure - the attacker must have local code execution on the target system. Scope is unchanged (S:U), so the impact is confined to the compromised host.

CVSS base score 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local privilege escalation requiring an already-authenticated attacker and high exploitation complexity. The high complexity metric is significant - UAF exploitation in kernel drivers typically demands precise memory grooming and timing, reducing opportunistic exploitation likelihood. No EPSS data is provided and no KEV listing or public POC is present, which - combined with AC:H - suggests this is a low-probability, targeted exploitation scenario in practice despite the complete C/I/A triad impact. The 'Denial Of Service' tag appears mislabeled; the description explicitly identifies privilege escalation as the impact, though a failed UAF exploitation could cause a kernel crash (BSOD) as a side effect. The breadth of affected Windows versions (from Server 2012 to Server 2025, Windows 10 1607 through Windows 11 26H1) means the attack surface is large, making patching high priority for environments where untrusted local users operate on shared systems or RDS/VDI deployments. No conflicting signals between description and CVSS vector - both indicate local, low-privilege, high-complexity access.

A low-privileged user logged onto a Windows system - via RDP, a shared workstation, or a compromised account - triggers the use-after-free in the Bluetooth Port Driver through a specially crafted sequence of driver I/O control calls that cause a kernel memory region to be freed and then reused in a controlled manner. With successful memory grooming (high complexity), the attacker redirects kernel execution to shellcode or a ROP chain, achieving SYSTEM-level privileges. No public exploit code has been identified at time of analysis.