Windows Bluetooth Service CVE-2026-83739

Exploitation requires the attacker to be within Bluetooth radio range (adjacent network, AV:A) of a Windows device that has Bluetooth enabled and the Windows Bluetooth Service running/reachable - the default state on most laptops, tablets, and Bluetooth-equipped desktops/servers. No authentication (PR:N) and no user interaction (UI:N) are needed. The principal limiting factors are physical/RF proximity and the High attack complexity (AC:H): because this is a use-after-free, the attacker must reliably win a memory-timing race, which reduces exploit reliability and makes automated or remote-at-scale attacks impractical. Devices with Bluetooth disabled or the service stopped are not exposed. Affected builds span Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2 through 26H2/26H1), and Windows Server 2019/2022/2025 below the fixed build numbers listed in the EUVD data.

Signals are consistent and point to a serious-but-not-emergency issue. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5 HIGH) describes an unauthenticated, no-user-interaction code-execution flaw that is reachable only from an adjacent (Bluetooth RF / same-link) network and carries High complexity, reflecting the timing/race nature typical of a use-after-free (CWE-416). CISA's SSVC framing aligns with this: Exploitation=none (no known in-the-wild activity), Automatable=no (adjacency and the AC:H race make mass-automated exploitation impractical), but Technical Impact=total (full compromise if successful). No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV listing and no public POC referenced, so this is a high-impact capability gated by meaningful preconditions (physical/RF proximity plus a reliable race win) rather than an actively exploited, internet-wide threat. Net: a genuine priority to patch on Bluetooth-enabled Windows endpoints (especially mobile/laptop fleets), but not a drop-everything remote-internet emergency. One caveat to verify: the input Tags include 'Denial Of Service' while the description states code execution - the UAF can plausibly yield both, but the RCE characterization should be treated as the primary impact.

An attacker within Bluetooth range of a victim Windows device (e.g., in an office, cafe, or conference) sends crafted Bluetooth traffic that triggers a use-after-free in the Windows Bluetooth Service, winning a timing race to reuse freed memory and execute attacker-controlled code with the service's privileges. No authentication or user interaction is required, but the High attack complexity means the attacker must reliably manipulate memory-allocation timing, and proximity is mandatory. No public exploit code is identified at time of analysis.