Windows Bluetooth Service EUVD-2026-99994

Exploitation requires the attacker to be within Bluetooth/adjacent-network radio range of the target (AV:A) and the Windows Bluetooth Service to be running with Bluetooth enabled on the victim host - the realistic default on laptops, tablets, and many desktops with Bluetooth radios. No authentication (PR:N) and no user interaction (UI:N) are needed, and complexity is low (AC:L), so a reachable, Bluetooth-enabled endpoint in default configuration is sufficient. The primary limiting factor is physical proximity: the flaw cannot be triggered over the internet or a routed network, which is why CISA SSVC rates it non-automatable; disabling Bluetooth or the Bluetooth Support Service removes the attack surface entirely.

This is a genuinely serious but not emergency-tier issue. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates an adjacent-network attack requiring no privileges, no user interaction, and low complexity, yielding total compromise (C:H/I:H/A:H) - a strong severity signal. However, exploitation signals are notably softer: there is no CISA KEV listing, no public proof-of-concept identified, and CISA SSVC rates Exploitation as 'none' and Automatable as 'no' (consistent with the AV:A requirement that the attacker be within Bluetooth/radio proximity, which prevents mass remote scanning or wormable automation). SSVC Technical Impact is 'total,' aligning with the CVSS CIA=High. Note a definitional tension worth flagging: the description frames this as an elevation-of-privilege flaw, yet the vector is PR:N (unauthorized attacker) delivered over AV:A - meaning the 'unauthorized' attacker gains SYSTEM-level privileges by reaching the service over the air rather than by escalating from an existing authenticated session; verify the intended privilege model with Microsoft. No EPSS score was provided in the input, so probabilistic exploitation likelihood could not be weighed. Net: real priority for patching (low-complexity, high-impact, unauthenticated), but the adjacency requirement and absence of KEV/POC make widespread opportunistic exploitation unlikely in the near term - treat as targeted-proximity risk, prioritizing mobile, kiosk, conference-room, and high-traffic-area endpoints.

An attacker positioned within Bluetooth radio range of a target Windows machine (e.g., an office, airport lounge, or conference room) transmits specially crafted Bluetooth traffic to the Windows Bluetooth Service. Because the flaw requires no authentication and no user interaction (AV:A/AC:L/PR:N/UI:N), the malformed data triggers a heap-based buffer overflow (CWE-122) in the service, which runs with high privileges, granting the attacker SYSTEM-level control. No public exploit code has been identified, and the attack cannot be performed remotely over the internet - physical/radio proximity is mandatory.