Windows Bluetooth Driver CVE-2026-83827

Exploitation requires the attacker to already have local, authenticated access to the target Windows host (PR:L, AV:L) - this is not remotely reachable and cannot be triggered across the network or by a remote unauthenticated actor. The vulnerable component is the Windows Bluetooth Port Driver, so the attack surface is reachable on standard Windows installations that load this driver (default across Windows 10/11 and Windows Server 2016-2025 per EUVD). Limiting factors: high attack complexity (AC:H) indicates a timing-sensitive or heap-grooming condition the attacker must reliably achieve, and the requirement for an existing authenticated foothold means this is an escalation primitive rather than an initial-access vector. No user interaction is required (UI:N).

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N) scores 7.0 (HIGH) and is internally consistent with the description's claim of local privilege elevation by an authorized attacker: the attacker must already be local and authenticated (PR:L), and the high attack complexity (AC:H) reflects the race/heap-grooming conditions typical of a heap buffer overflow (CWE-122) in a kernel-mode driver. Crucially, exploitation signals are LOW despite the HIGH severity: CISA SSVC records Exploitation=none and Automatable=no, no KEV listing exists, and no public exploit was provided in the input - so active exploitation is not indicated. This contrasts with the Technical Impact=total in SSVC and the C:H/I:H/A:H impact metrics, which correctly show that successful exploitation yields full SYSTEM-level compromise of the host. The net picture is a real, patch-worthy local EoP that an attacker would chain after initial access, not an internet-facing or self-propagating threat. No EPSS score was supplied, so widespread-exploitation probability cannot be independently quantified; the AC:H and local-only vector argue against opportunistic mass abuse.

An attacker who has already gained low-privileged, authenticated access to a Windows host (e.g., via phishing or a prior foothold) triggers a crafted sequence against the Bluetooth Port Driver to corrupt heap memory and win a timing-sensitive race, overwriting kernel structures to escalate to SYSTEM. No user interaction is required, but the high attack complexity means the exploit may need multiple attempts. No public proof-of-concept was identified in the provided data.