CVE-2026-45605

What it actually does

CVE-2026-45605 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Bluetooth Service. A locally authenticated attacker can trigger improper object lifetime handling in the Bluetooth service and potentially corrupt memory in a privileged service process. Successful exploitation can allow code execution with elevated privileges, enabling the attacker to move from a low-privileged local account to a highly privileged Windows context and gain full control over confidentiality, integrity, and availability on the affected system.

Why it matters to the business

If exploited, this flaw can turn a limited local compromise into full host compromise on affected Windows workstations and servers. It is especially relevant on systems where attackers may already have a foothold through phishing, stolen credentials, malware, remote access tools, or exposed user accounts. Although it is not currently listed in CISA KEV, has low EPSS, and has no reported public exploit maturity, the CVSS 7.8 severity means organizations should treat it as a meaningful post-compromise escalation risk across supported Windows 10, Windows 11, and Windows Server fleets.

How an attack unfolds

An attacker first obtains local authenticated access to an affected Windows system, such as through a compromised user account, malware execution, or interactive access. The attacker then invokes or interacts with the Windows Bluetooth Service in a way that triggers the use-after-free condition. By carefully shaping memory around the freed object, the attacker attempts to redirect execution flow or manipulate service memory to run attacker-controlled code in the context of the privileged Bluetooth service process. Once elevated, the attacker can install persistence, disable security controls, access protected data, dump credentials, tamper with logs, or use the host as a staging point for lateral movement. Because this is a local vulnerability, it is typically chained after initial access rather than used as the first entry point.

How to fix it

Apply the applicable Microsoft security update or cumulative update that remediates CVE-2026-45605 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1; and Windows Server 2016, 2019, 2022, and 2025. Because no exact fixed build numbers were provided in the input, use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or an equivalent patch-management platform to verify the latest security cumulative update is installed. Where immediate patching is not possible, reduce exposure by disabling Bluetooth functionality and the Bluetooth Support Service where operationally unnecessary, restricting local logon rights, minimizing standard-user execution paths, enforcing endpoint detection controls, and preventing untrusted users from running arbitrary code on affected systems. Mitigation should not be considered a substitute for patching because the vulnerability is local and may still be exploitable by any authenticated user or malware already running on the device.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows system has installed the Microsoft security update or cumulative update that includes the fix. Use centralized patch compliance reporting and spot checks with Windows Update history, Get-HotFix, DISM package inventory, or enterprise endpoint management tooling. Validate that unsupported or out-of-policy Windows builds are not present. If Bluetooth has been disabled as a temporary mitigation, confirm the Bluetooth Support Service is stopped and disabled where business-approved. Security teams should also confirm that standard users cannot restart disabled services or install drivers that re-enable Bluetooth functionality. For exposure validation, inventory systems running affected Windows versions and identify hosts where the Bluetooth Support Service is installed, enabled, or actively running.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server using stolen credentials, malware, phishing, or another vulnerability.
2. Confirm the Windows version and whether the Bluetooth Service component is present and reachable.
3. Run a local exploit that triggers the use-after-free condition in the Windows Bluetooth Service.
4. Shape process memory to convert the memory corruption into elevated code execution.
5. Spawn or inject a process running with higher privileges.
6. Disable defenses, collect credentials, establish persistence, or move laterally to other systems.

How to detect it

There are no public, CVE-specific exploitation indicators provided, and use-after-free privilege escalation attempts may leave limited forensic evidence if successful. Detection should focus on behavioral evidence around the Windows Bluetooth Service and post-exploitation activity. Review Windows Event Logs, Sysmon or EDR telemetry, service control events, crash dumps, Windows Error Reporting records, process creation logs, and security logs for unusual activity by low-privileged users followed by elevated processes. Look for abnormal crashes of svchost.exe instances hosting the Bluetooth Support Service, repeated service restarts, unexpected child processes from service-hosting processes, suspicious token elevation, credential dumping tools, new services, scheduled tasks, registry run keys, or security-control tampering shortly after Bluetooth service faults. Relevant log sources include Windows Security events 4688, 4672, 4624, 4627, 7045 from System logs for service installation, Service Control Manager events 7031 and 7036, Sysmon process creation and process access events, Windows Error Reporting, EDR memory-corruption detections, and application crash telemetry. If artifacts are found, preserve memory, collect crash dumps, export service and process telemetry, and investigate the account that was active before the suspected privilege escalation.

• bthserv
• Bluetooth Support Service
• Faulting application name: svchost.exe
• Faulting module name: bthserv.dll
• Service Control Manager
• Event ID 7031
• Event ID 7036
• Event ID 7045
• C:\Windows\System32\bthserv.dll
• svchost.exe -k LocalService
• svchost.exe -k LocalServiceNetworkRestricted

What your security team should do

• Prioritize patching on shared workstations, administrator workstations, jump hosts, developer endpoints, kiosks, VDI images, and servers where local user access is allowed.
• Deploy the relevant Microsoft cumulative security updates through enterprise patch management and track completion across all affected Windows 10, Windows 11, and Windows Server versions.
• Temporarily disable Bluetooth and the Bluetooth Support Service on systems that do not require Bluetooth, especially servers and privileged-access workstations.
• Harden local privilege boundaries by removing unnecessary local administrator rights, restricting interactive logon, and enforcing application control where feasible.
• Monitor for suspicious activity involving the Bluetooth service process, unexpected service crashes, privilege escalation behavior, credential dumping, and new persistence after local user activity.
• Treat exploitation as a post-compromise signal: investigate the original access vector if signs of abuse are found.
• Because the vulnerability is not currently in KEV and EPSS is low, sequence remediation through normal high-severity patch SLAs unless compensating risk factors exist, such as broadly shared systems or active malware presence.