Windows Bluetooth Service CVE-2026-69889

Exploitation requires a locally authenticated account on the target system - the CVSS PR:L confirms low-privilege credentials suffice; no administrator or elevated token is needed to initiate the attack. The Windows Bluetooth Support Service (bthserv) must be running, which is its default state on Windows installations where Bluetooth hardware is present or enabled. Attack complexity is high (AC:H), meaning exploitation requires winning a race condition and is not trivially repeatable on demand. Exploitation is limited to: local access (physical, RDP, or prior code execution); Bluetooth service in running state; and successful race condition timing. Remote unauthenticated exploitation is not supported by this vulnerability.

CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) places this as a high-severity local privilege escalation with meaningful exploitation difficulty. AV:L and PR:L confirm an authenticated local user is the threat actor, not a remote unauthenticated one - reducing the exposed attack surface significantly. AC:H is consistent with a race condition requiring precise timing, which raises the exploitation bar beyond trivial. No EPSS data was provided in the input; absent KEV listing or known POC, real-world exploitation urgency is uncertain but not dismissible given the ubiquity of Windows and the value of SYSTEM privileges. The Denial Of Service tag is partially supported by A:H in the CVSS, but the primary disclosed impact is privilege escalation, not pure DoS - risk assessment should weight LPE higher than the tag implies. This falls into the category of a real patch priority for enterprise environments where lateral movement via LPE is a key attacker technique, even if not imminently weaponized.

A low-privileged local user logs into a Windows workstation (or gains code execution via a separate initial access vulnerability) and sends crafted Bluetooth service requests designed to trigger the use-after-free race condition. By precisely timing concurrent operations to win the race, the attacker corrupts freed memory in the Bluetooth Service's address space and redirects execution to attacker-controlled code, escalating to SYSTEM privileges. No public proof-of-concept has been identified at time of analysis, but the technique is consistent with well-understood Windows kernel/service memory exploitation primitives.