Windows Bluetooth Driver EUVD-2026-35684

The attacker must already have an authenticated local session on the target Windows host with at least standard user privileges (CVSS PR:L) and the ability to open a handle to the Bluetooth Port Driver - meaning the Bluetooth stack must be installed and the bthserv service running, which is the default on Windows client SKUs with Bluetooth hardware but is typically absent on hardened servers without Bluetooth radios. Exploitation is limited by high attack complexity (AC:H), indicating a race condition or specific kernel-object state must be won, which generally requires multiple attempts and stable timing; no user interaction is required (UI:N), and the attack cannot be launched over the network (AV:L). Systems without Bluetooth hardware or with the Bluetooth service disabled are not exploitable.

The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates a local attack requiring low privileges, no user interaction, and high attack complexity - the latter reflecting the race-condition or specific-state-trigger nature typical of UAF bugs. The S:U scope is technically conservative for a kernel driver flaw, but C/I/A:H confirm full host compromise on success. There is no KEV listing, no EPSS score, and no POC referenced in the provided data, suggesting this is currently a theoretical-but-credible escalation primitive rather than an actively weaponized chain. The 'Denial Of Service' tag is consistent with UAF bugs whose simplest failure mode is a kernel BSOD even when full code execution is not achieved. Realistic priority: high for endpoint fleets with untrusted local users (kiosks, shared workstations, malware sandboxes) where it could chain with an RCE; moderate for tightly controlled corporate endpoints.

A standard user with interactive logon (e.g., on a shared workstation or via a compromised user-mode foothold from phishing) opens handles to the Bluetooth Port Driver and races IOCTL or device-event sequences to free a kernel object while another thread still holds a reference, then sprays the freed slot with attacker-controlled data to hijack a callback or vtable pointer. On success, arbitrary code executes in kernel mode, granting SYSTEM and disabling EDR/anti-malware controls. No public exploit identified at time of analysis, and the high attack complexity (AC:H) implies reliable exploitation likely requires precise timing or heap-grooming primitives.