Microsoft Bluetooth Driver CVE-2026-83776

Exploitation requires physical/local access to the affected device to deliver crafted input to the Microsoft Bluetooth driver (AV:P); the Bluetooth stack must be present and reachable by the attacker at the hardware level. No authentication (PR:N) and no user interaction (UI:N) are required once physical access is achieved, and attack complexity is low (AC:L). The decisive limiting factor is the physical-access requirement, which prevents remote or networked exploitation and makes the flaw non-automatable (SSVC Automatable=no); realistic risk is confined to scenarios of lost, stolen, unattended, or physically accessible endpoints. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2016/2019/2022/2025 below the listed patch levels.

This is a medium-severity (CVSS 6.8) local privilege-escalation flaw whose risk is strongly tempered by its attack vector. The CVSS vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) requires PHYSICAL access to the target, which is the single biggest limiter - no authentication (PR:N) and no user interaction (UI:N) are needed once the attacker is physically present, and the impact is total (C:H/I:H/A:H). CISA's SSVC framework reinforces a lower priority: Exploitation=none (no observed or public exploitation) and Automatable=no (physical access cannot be scaled/wormed), even though Technical Impact=total. These signals are consistent rather than conflicting - high technical impact but a vector that cannot be exploited remotely or at scale. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this gap should be noted rather than assumed. There is no CISA KEV listing and no public POC, so this is a high-impact-but-physically-gated issue that is a patch-management priority for high-value or physically-exposed endpoints (kiosks, laptops in hostile environments, lost/stolen devices) rather than an urgent fleet-wide emergency.

An attacker with brief physical possession of a device (e.g. a stolen, borrowed, or evil-maid-targeted laptop) sends specially crafted data to the Windows Bluetooth stack, triggering an out-of-bounds read in the Bluetooth driver that corrupts kernel memory and elevates the attacker to SYSTEM. Because the CVSS vector is AV:P/AC:L/PR:N/UI:N, no login credentials or user interaction are required once physical access is obtained. No public exploit code is identified at time of analysis.