A heap‑based buffer overflow exists in the Windows Bluetooth Port Driver that permits an attacker who can reach the target over an adjacent network to execute arbitrary code. This flaw can compromise confidentiality, integrity, and availability by allowing the attacker to gain full control of the affected system.

Affected products are Microsoft Windows operating systems, including Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, for both standard and Server Core installations. These versions are identified by the supplied CPE strings.

The CVSS score of 8.0 classifies this flaw as high severity. The EPSS score of less than 1% indicates a low probability of exploitation as of the latest assessment, and the vulnerability is not listed in the CISA KEV catalog. An attacker would need to be able to contact the target over an adjacent network, after which the malicious payload can be delivered via the Bluetooth port driver, granting the attacker full control of the machine.