Windows Bluetooth Port Driver CVE-2026-87713

Exploitation requires the attacker to be within Bluetooth adjacency (radio range) of a target running an unpatched Windows build with the Bluetooth stack active and the Bluetooth Port Driver reachable - there is no remote/internet-routable path (AV:A). No authentication (PR:N) or user interaction (UI:N) is needed, but success is gated by high attack complexity (AC:H): the attacker must reliably trigger and win the use-after-free race condition in the driver, which is non-deterministic and non-automatable per SSVC. Limiting factors that reduce real-world risk: mandatory physical proximity, the requirement that Bluetooth be enabled/active on the target, and the unreliable timing-dependent nature of the UAF.

Signals point to a genuine but non-urgent High-severity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N) describes an unauthenticated attacker (PR:N) requiring no user interaction (UI:N) but constrained to an adjacent network - in practice Bluetooth radio proximity - and facing high attack complexity (AC:H), which for a CWE-416 use-after-free typically means winning a non-deterministic race or grooming kernel memory. Impact is total (C:H/I:H/A:H), consistent with an elevation-of-privilege flaw yielding kernel/SYSTEM control. CISA's SSVC framework reinforces a lower urgency: Exploitation=none (no observed activity), Automatable=no (cannot be reliably scripted at scale, matching AC:H and the proximity requirement), yet Technical Impact=total. The vulnerability is NOT in CISA KEV and no POC is referenced, so this is not confirmed exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: this is a legitimate patch-worthy flaw but the combination of adjacent-only vector, high complexity, non-automatable nature, and absence of exploitation evidence places it below internet-facing or wormable criticals - prioritize the patch in a normal cycle, accelerating only for high-value endpoints with Bluetooth enabled in exposed physical environments.

An attacker within Bluetooth range of a target Windows machine (e.g., a shared office, conference venue, or public space) sends crafted Bluetooth traffic that triggers a use-after-free in the Windows Bluetooth Port Driver, then wins the memory race to corrupt kernel structures and elevate to SYSTEM. No credentials or user interaction are required, but the high attack complexity (AC:H) means exploitation is unreliable and physical proximity is mandatory. No public exploit identified at time of analysis.