CVE-2026-45640

What it actually does

This is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Bluetooth Port Driver, commonly associated with the Windows kernel Bluetooth stack. A low-privileged, authenticated local attacker can potentially trigger incorrect object lifetime handling, cause the kernel to reference freed memory, and manipulate memory reuse to gain kernel-level execution. Successful exploitation can allow escalation from a standard user context to highly privileged local SYSTEM or kernel-level privileges, enabling full control of the affected Windows host. The CVSS vector indicates local access is required, no user interaction is needed, privileges are required, and exploitation complexity is high, meaning reliable exploitation likely depends on timing, heap grooming, race conditions, or target-specific behavior.

Why it matters to the business

If exploited, an attacker who already has a foothold on a Windows workstation or server could turn limited access into full control of the device. That can enable credential theft, security tool tampering, lateral movement, persistence, data theft, or destructive actions. The issue affects multiple widely deployed Windows client and server versions, including Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025, so exposure may be broad in organizations with mixed Windows fleets. Current public risk signals are lower—EPSS is low, it is not listed in CISA KEV, ransomware use is not reported, and exploit maturity is listed as none—but the impact of successful exploitation is severe because it can convert a low-privileged compromise into full host compromise.

How an attack unfolds

An attacker first needs local authenticated access to an affected Windows system, such as through stolen credentials, malware running as a standard user, a compromised helpdesk session, or prior exploitation of another vulnerability. The attacker then invokes Bluetooth-related kernel functionality exposed through the Windows Bluetooth stack and attempts to trigger the use-after-free condition in the Bluetooth Port Driver. Because exploitation complexity is high, the attacker likely needs to carefully shape kernel heap memory, manipulate object allocation and release timing, and repeatedly trigger the vulnerable code path until the freed memory is reused in a controlled way. If successful, the attacker obtains a kernel read/write or execution primitive and uses it to modify process tokens, disable security controls, load malicious kernel-adjacent components, or spawn a process as SYSTEM. After privilege escalation, the attacker may dump credentials, establish persistence, move laterally, or use the host as a staging point for broader compromise.

How to fix it

Apply the latest Microsoft security updates or cumulative updates for the affected Windows versions. Because exact fixed build numbers were not provided, use Microsoft Security Update Guide, Windows Update, WSUS, Microsoft Configuration Manager, Intune, or another trusted patch-management source to confirm that each affected Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 system has received the security update that remediates this vulnerability or a later cumulative update. Prioritize systems where untrusted users can log in locally, shared workstations, developer workstations, jump hosts, remote desktop servers, and systems where Bluetooth is enabled. Where immediate patching is not possible, reduce exposure by disabling Bluetooth hardware and services where not operationally required, limiting local interactive logon rights, enforcing least privilege, using application control to prevent untrusted local binaries, and monitoring for local privilege escalation behavior. Mitigations should be treated as temporary because disabling Bluetooth or restricting access does not remove the vulnerable driver code from the system.

How to confirm the fix worked

Confirm remediation by checking that affected systems have installed the relevant Microsoft cumulative update released for this vulnerability or a later superseding update. Validate through centralized patch inventory, Windows Update history, WSUS/MECM/Intune compliance reports, or local commands such as Get-HotFix, systeminfo, and winver, then cross-reference installed build and KB levels against the Microsoft Security Update Guide. On representative systems, verify the installed bthport.sys file version and timestamp are consistent with the patched cumulative update. Confirm that unsupported or out-of-servicing Windows builds have been upgraded or otherwise removed from production use. If using temporary mitigations, verify Bluetooth radios, Bluetooth services, and Bluetooth device access policies are disabled or restricted where intended, but do not count mitigation-only systems as fully remediated.

Typical attack path

1. Gain low-privileged local access to an affected Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system.
2. Confirm the target has the vulnerable Windows Bluetooth stack and that Bluetooth-related driver components are present or reachable.
3. Run local exploit code that interacts with Bluetooth Port Driver functionality and attempts to trigger the use-after-free condition.
4. Use heap grooming, timing, or repeated attempts to gain controlled reuse of freed kernel memory.
5. Convert the memory corruption into kernel-level code execution or an arbitrary kernel memory read/write primitive.
6. Modify security-relevant kernel structures, such as process privileges or access tokens, to elevate to SYSTEM.
7. Launch a privileged process or implant, disable defenses, access sensitive files, dump credentials, or prepare for lateral movement.

How to detect it

There are no widely established public exploit indicators provided for this vulnerability, and local privilege escalation activity often leaves limited network evidence. Focus detection on endpoint telemetry, Windows event logs, EDR process lineage, crash artifacts, and driver-related evidence. Review Windows Security logs for unusual privilege escalation outcomes, including new processes running as SYSTEM that originated from a low-privileged user context, unexpected service creation, scheduled task creation, security tool tampering, credential dumping, and changes to local administrator membership. Review System logs, Reliability Monitor data, Windows Error Reporting, memory dumps, and EDR crash telemetry for crashes or bugchecks referencing bthport.sys or the Bluetooth stack, especially when followed by successful privileged execution. Look for repeated execution of unknown binaries by standard users immediately before SYSTEM-level process creation. Useful log sources include Windows Security Event Log, System Event Log, Sysmon, PowerShell logs, EDR telemetry, Windows Error Reporting, crash dump directories, service control manager events, scheduled task logs, and local group membership change events. Treat Bluetooth-driver crashes as suspicious leads rather than definitive proof, because legitimate driver faults can produce similar artifacts.

• bthport.sys
• Bluetooth Port Driver
• IMAGE_NAME: bthport.sys
• MODULE_NAME: bthport
• Faulting module name: bthport.sys
• SystemRoot\\System32\\drivers\\bthport.sys
• C:\\Windows\\System32\\drivers\\bthport.sys
• Event ID 7045
• A service was installed in the system
• Event ID 4697
• Event ID 4688
• Event ID 4672
• Event ID 4732
• Event ID 4698

What your security team should do

• Patch affected Windows clients and servers with the latest Microsoft cumulative security update, prioritizing systems that allow local user access or have Bluetooth enabled.
• Use endpoint management data to identify Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 assets and verify update compliance.
• Temporarily disable Bluetooth on systems where it is not required, especially shared workstations, administrative systems, kiosks, and servers.
• Review local administrator group membership, remote desktop access, and interactive logon rights to reduce the number of users who could exploit a local privilege escalation flaw.
• Ensure EDR is configured to alert on privilege escalation patterns, suspicious token manipulation, unexpected SYSTEM shells, credential dumping, and tampering with security tools.
• Hunt for suspicious crashes or bugchecks involving bthport.sys, especially if followed by new SYSTEM-level processes, credential access, or security control changes.
• Because this is not currently KEV-listed and has low EPSS, treat it as important but not necessarily emergency-level unless the organization has high local-user exposure, shared endpoints, or elevated threat activity.