Microsoft Bluetooth Driver CVE-2026-83868

Requires an authorized, low-privileged local user account on the target Windows host (PR:L) and no user interaction (UI:N); the attacker must then win a timing-dependent race in the Microsoft Bluetooth Driver's handling of a shared resource that lacks proper synchronization (CWE-362). Exploitation is strongly LIMITED by high attack complexity (AC:H): the race window is non-deterministic, so success is unreliable and not automatable (SSVC Automatable=no), and the attacker must already have local code execution. There is no remote vector (AV:L), so network-only attackers cannot trigger this.

This is a moderate-priority local elevation-of-privilege flaw, not an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.0 High) describes a locally-exploitable race condition that requires an already-authenticated low-privileged account (PR:L) and winning a timing-dependent race (AC:H), but yields total compromise (C:H/I:H/A:H) consistent with full SYSTEM-level privilege gain. CISA's SSVC framework reinforces the lower urgency: Exploitation=none (no observed or public exploitation), Automatable=no (the AC:H race window cannot be reliably scripted at scale), yet Technical Impact=total (matching the C/I/A:H impact). These signals are internally consistent - high technical impact but constrained, non-trivial exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified; this is a data gap, not a low score. The CVE is NOT in CISA KEV and no POC is referenced, so there is no public exploit identified at time of analysis. The practical takeaway: because the product (Windows Bluetooth stack) is ubiquitous and the impact is total, this warrants patching in the normal monthly cycle, but the local-only vector, required authentication, and high attack complexity make it unsuitable for mass exploitation and lower priority than any network-reachable or KEV-listed flaw.

An attacker who already has a low-privileged local account on a Windows host (for example via a compromised standard user session or a sandboxed app escape) repeatedly triggers Bluetooth driver operations to hit a narrow timing window in which shared resources are accessed without proper synchronization. By winning that race, the attacker corrupts kernel state and elevates to SYSTEM, giving full control of the machine. No public exploit code is identified at time of analysis, and the high attack complexity (AC:H) means exploitation is unreliable rather than turnkey.