Windows Bluetooth Service EUVD-2026-72974

The attacker must hold a low-privileged local account on the target Windows system (CVSS PR:L) and be able to execute code locally (AV:L). The Windows Bluetooth Support Service (bthserv) must be in a running state - it is enabled by default on most Windows client and server installations where Bluetooth hardware is present. Winning the race condition requires successful timing of concurrent threads (AC:H), which may demand repeated attempts and is sensitive to system load. No user interaction is required (UI:N). Remote unauthenticated attackers cannot directly trigger this vulnerability. Systems where bthserv is administratively stopped or disabled, or where no local logon path exists for unprivileged accounts, are not practically exploitable.

The CVSS 7.0 score with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a constrained but impactful post-access escalation primitive. The high attack complexity (AC:H) is the primary mitigating factor - race conditions require precise timing and typically multiple attempts, reducing reliability and making automated mass exploitation impractical. The local attack vector (AV:L) means this vulnerability cannot be triggered remotely by an unauthenticated adversary; it is squarely a privilege escalation tool for attackers who have already obtained a foothold. KEV status is not confirmed, and no public exploit code is referenced in available intelligence, suggesting this has not yet been operationalized in widespread campaigns. EPSS data is absent from the provided intelligence. The real-world priority is moderate: organizations running Windows endpoints or servers without the latest patches should apply the update in their next scheduled patch cycle - even a small municipal IT team in kalisz faces meaningful insider-threat or post-breach escalation risk without this fix - but the high complexity and local-only vector do not warrant emergency out-of-band patching absent evidence of targeted exploitation.

An attacker who has already obtained a low-privileged interactive or RDP session on a Windows endpoint - via phishing, credential theft, or initial access - writes tooling that repeatedly spawns concurrent threads targeting the Bluetooth Service's unsynchronized shared resource, attempting to win the race window. Upon winning the race, the service processes attacker-influenced data at elevated privilege, allowing the attacker to escalate to SYSTEM. No public proof-of-concept code has been identified, meaning exploitation currently requires custom tooling and some reliability engineering against the timing window.