CVE-2026-45605: Windows Bluetooth Service Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability in the Windows Bluetooth Service allows a locally authenticated attacker to elevate privileges on affected Windows 10 and Windows 11 systems. The bug is reachable from a low-privilege user account without any network access, and exploitation requires no victim interaction. Successful exploitation grants the attacker full control over the affected host, including reading sensitive data, modifying system state, and crashing or disrupting services. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker does not need administrative or elevated credentials before exploiting the vulnerability.

• Victim interactionNot required

  No user interaction of any kind is needed; the attacker can trigger the use-after-free entirely from their own process.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads high-confidentiality data from the affected host, including credentials, tokens, and other sensitive process memory.
• The attacker modifies system files, registry keys, or other persisted state with full write access at an elevated privilege level.
• The attacker crashes or disrupts the affected service or the broader operating system, causing denial of service on that host.
• Because privilege is fully elevated, the attacker can install persistent backdoors or pivot to other resources accessible from the compromised host.