A race condition in the Windows Bluetooth RFCOM Protocol Driver allows a local attacker, who has authorized access to the system, to elevate privileges. Improper synchronization of a shared resource during concurrent execution gives the attacker a path to gain higher permissions, potentially compromising the entire system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3, 26H1; Microsoft Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025 (including core installations).

The vulnerability carries a CVSS score of 7.0, indicating a high potential impact, but an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The attack vector is local and requires the attacker to be authorized on the system. The flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, further indicating that it has not been observed in widespread attacks yet. Nonetheless, local privilege escalation remains a severe risk, especially in environments where privileged users or applications are able to interact with the Bluetooth stack.