The flaw is a use‑after‑free condition in the Windows Bluetooth Service. An attacker who can execute code on the machine with local authorization can exploit the dangling reference to cause the service to run with elevated privileges. This elevation of privilege can allow the attacker to gain administrative or system rights, install or modify software, and potentially persist or move laterally within the local environment.

Affected configurations include Microsoft Windows 10 from version 1607 through 22H2, Microsoft Windows 11 from 23H2 through 26H1, and Windows Server editions 2016, 2019, 2022, and 2025. All listed builds, regardless of architecture, carry the vulnerability.

The CVSS score of 7.8 indicates a high severity that can be exploited locally without network or remote access. EPSS data is not available, so the exact exploitation probability cannot be quantified. The vulnerability is not present in the CISA KEV catalog, suggesting no current widespread exploitation is documented. Because the attack requires local authorization, the risk is significant for users with administrative privileges who have not applied the Microsoft update that addresses the issue.