CVE-2026-58538

What it actually does

CVE-2026-58538 is a local privilege escalation vulnerability caused by a heap-based buffer overflow in the Windows Bluetooth Service. An attacker who already has authorized local access can send crafted input to the Bluetooth service to corrupt heap memory and potentially execute code in the context of the privileged service. Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability on the affected Windows host, including escalation from a low-privileged user context to an administrative or system-level context.

Why it matters to the business

This flaw does not provide initial remote access by itself, but it can turn a limited local compromise into full control of an affected Windows workstation or server. In practical terms, malware, an insider, or an attacker with stolen low-privilege credentials could use it to disable security tooling, access sensitive files, steal credentials, install persistence, or move laterally. The risk is highest on shared workstations, VDI/kiosk systems, developer machines, jump hosts, and any server where Bluetooth components are installed or enabled. The CVSS score is high at 7.8, but current public exploitation signals are low: EPSS is 0.00311, it is not listed in CISA KEV, and no exploit maturity is reported. Organizations should still patch in normal high-severity Windows maintenance cycles because local privilege escalation vulnerabilities are commonly chained with phishing, credential theft, or initial-access malware.

How an attack unfolds

An attacker first obtains local code execution or an interactive session on an affected Windows system using any low-privileged authorized account. The attacker then targets the Windows Bluetooth Service and supplies crafted Bluetooth-related input that triggers a heap-based buffer overflow. By shaping the overflow, the attacker attempts to corrupt heap metadata, overwrite control data, or otherwise influence execution flow inside the service process. If exploitation succeeds, attacker-controlled code runs with the privileges of the Bluetooth service rather than the original low-privileged account. From that elevated context, the attacker can create privileged accounts, dump credentials, tamper with endpoint defenses, access protected data, deploy persistence, or use the host as a staging point for lateral movement. Because no public exploit maturity or KEV listing is reported, defenders should focus on patching and on detecting suspicious local privilege escalation behavior rather than assuming widespread exploitation.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-58538 for all affected Windows versions, including Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, WSUS, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the latest cumulative update applicable to each supported OS version. Reboot systems where required and verify the update is installed. Where patching must be delayed, reduce exposure by disabling Bluetooth and the Bluetooth Support Service on systems that do not require it, removing unused Bluetooth adapters where feasible, restricting local logon rights, hardening endpoint privilege controls, and monitoring for service crashes or suspicious post-escalation activity. Disabling Bluetooth is a mitigation, not a substitute for applying the vendor fix.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the Microsoft cumulative security update released to address this vulnerability or a later cumulative update. Validate through centralized patch inventory, Windows Update history, PowerShell-based hotfix/build checks, or endpoint management compliance reports. Confirm that affected Windows versions are no longer missing the applicable July 2026-or-later security update. For systems using mitigation instead of immediate patching, verify that Bluetooth is not required, the Bluetooth Support Service is disabled or not running, and Bluetooth adapters are disabled or removed. Also review system stability after patching and confirm there are no recurring Bluetooth service crashes or unexpected restarts.

Typical attack path

1. Gain local access to an affected Windows 10, Windows 11, Windows Server 2019, Windows Server 2022, or Windows Server 2025 system using a low-privileged account.
2. Confirm that Bluetooth components or the Windows Bluetooth Service are present and reachable locally.
3. Run exploit code that sends crafted input to the Windows Bluetooth Service to trigger the heap-based buffer overflow.
4. Achieve code execution or privilege escalation in the context of the privileged Bluetooth service process.
5. Use the elevated privileges to disable defenses, access protected files, dump credentials, create persistence, or launch additional tooling.
6. Move laterally or continue post-exploitation using the newly obtained privileges.

How to detect it

There are no publicly reported exploit-specific indicators in the provided data, so detection should focus on likely artifacts of exploitation attempts and successful local privilege escalation. Collect and review Windows Event Logs, especially System, Application, Security, Service Control Manager, Windows Error Reporting, PowerShell, and Sysmon/EDR telemetry. Look for crashes or restarts of the Bluetooth Support Service, svchost.exe processes hosting Bluetooth components, or faulting modules associated with Bluetooth immediately followed by suspicious privilege escalation behavior. Relevant events include Application Error or Windows Error Reporting records for svchost.exe with Bluetooth-related modules, Service Control Manager events indicating the Bluetooth service terminated unexpectedly, and Security events showing new privileged logons, local administrator group changes, service creation, scheduled task creation, or endpoint security tampering. Correlate any Bluetooth service instability with subsequent process creation from unusual user-writable paths, credential access tooling, LSASS access, new local accounts, changes to local Administrators membership, or unexpected administrative command execution. Because exploitation is local, network indicators are unlikely unless paired with attacker tooling, lateral movement, or command-and-control activity.

• bthserv
• Bluetooth Support Service
• bthserv.dll
• C:\Windows\System32\bthserv.dll
• svchost.exe -k LocalService
• Faulting application name: svchost.exe
• Faulting module name: bthserv.dll
• The Bluetooth Support Service service terminated unexpectedly
• Service Control Manager 7031
• Service Control Manager 7034
• Windows Error Reporting
• Application Error 1000

What your security team should do

• Prioritize patching high-risk Windows endpoints where local privilege escalation would materially increase impact: shared workstations, VDI, kiosks, developer systems, privileged admin workstations, jump hosts, and servers with Bluetooth components enabled.
• Deploy the applicable Microsoft cumulative security update through standard Windows patch management and require reboot completion where needed.
• Inventory affected Windows 10, Windows 11, and Windows Server versions and identify systems with Bluetooth services, drivers, or adapters enabled.
• Disable Bluetooth and the Bluetooth Support Service on systems that do not require Bluetooth functionality, especially servers and privileged-access workstations.
• Monitor Windows logs for Bluetooth service crashes, svchost.exe failures tied to Bluetooth components, and suspicious activity immediately following such crashes.
• Hunt for post-exploitation behaviors such as new local administrators, credential dumping attempts, endpoint protection tampering, suspicious scheduled tasks, and unexpected service creation.
• Treat this as a privilege-escalation risk rather than an internet-exposed remote-code-execution risk; prioritize it alongside controls that limit initial footholds and local account abuse.
• Because this vulnerability is not currently in CISA KEV and has low EPSS, use normal high-severity patch SLAs unless compensating risk factors exist, such as exposed shared systems, active malware incidents, or broad Bluetooth usage.