CVE-2026-45640: Windows Bluetooth Port Driver Elevation of Privilege Vulnerability

Synopsis

A use-after-free vulnerability exists in the Windows Bluetooth Port Driver, affecting Windows 10, Windows 11 (multiple versions), and Windows Server 2022. Exploitation requires an attacker to already have a low-privilege account on the target machine and to win a race condition or satisfy specific memory-layout requirements; no network access or victim interaction is needed. Successful exploitation grants the attacker full elevated privileges on the local system. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows base images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative credentials are needed to attempt exploitation.

• Victim interactionNot required

  No user action or social engineering is required; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Exploitation involves high complexity, requiring the attacker to win a race condition or satisfy specific memory-layout conditions before the vulnerability can be triggered reliably.

Blast Radius

• Reads sensitive data accessible to the process or user context elevated to, including credentials or secrets stored on the host.
• Modifies system files, registry keys, or other persisted resources protected by privilege boundaries.
• Terminates or disrupts system services and processes that the original low-privilege account could not ordinarily touch.
• Establishes a foothold with elevated permissions that can be used to pivot to further compromise of the host or connected systems.