Windows Bluetooth Service EUVD-2026-73488

Exploitation requires an existing authenticated low-privileged local account or code execution context on the target system (PR:L per CVSS vector) - unauthenticated remote attackers cannot directly exploit this vulnerability. The Windows Bluetooth Service must be running, which is the default state on most Windows 10 and Windows 11 desktop and laptop installations; it may be disabled on hardened server deployments. Exploitation is probabilistic rather than deterministic (AC:H) due to the race condition nature: an attacker must win a timing window between a permission check and a privileged operation, requiring repeated attempts or manipulation of system scheduling conditions. No specific Bluetooth hardware, paired device, or pairing state is described as a prerequisite. Scope is limited to the local system (S:U), meaning successful exploitation does not automatically extend to adjacent network resources.

The CVSS 7.0 score accurately reflects a constrained but consequential attack profile. AV:L limits the attack surface to users or processes already executing on the target host, while AC:H acknowledges that winning a race condition requires specific timing, repeated attempts, or manipulation of system load - this is not a one-shot deterministic exploit. Despite these constraints, the C:H/I:H/A:H impact metrics are justified because a successful race win yields SYSTEM-level code execution with full control over the compromised host. Race-condition EoP flaws in Windows services are a well-established component of multi-stage intrusion chains, commonly paired with initial-access RCE exploits - even a mid-sized municipal IT team in swidnica should treat this as urgent patching work given how frequently this class of bug is chained in post-exploitation toolkits. No POC has been publicly identified and the CVE is not in the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of analysis. The Bluetooth service is enabled by default on most Windows desktop and laptop builds, broadening the realistic attack surface beyond servers. No conflicts between the CVSS vector and the vulnerability description were identified.

An attacker who has gained a low-privileged local shell on a Windows system - for example via a phishing payload or a chained RCE vulnerability - launches multiple concurrent threads targeting the Windows Bluetooth Service's shared resource. If the attacker wins the synchronization race, the service executes a privileged operation in the attacker's thread context, granting SYSTEM-level code execution. No public POC is known, but this technique class is well-documented and routinely incorporated into post-exploitation frameworks targeting unpatched Windows hosts.