The vulnerability is an out‑of‑bounds read in the Windows Bluetooth Port Driver that can be triggered to execute arbitrary code on a nearby device. This flaw is a classic buffer over‑read (CWE‑125) combined with insufficient input validation (CWE‑20). If exploited, the attacker could gain code execution privileges, compromising confidentiality, integrity and availability of the affected system.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, plus Windows 11 23H2 and 26H1; and a range of Windows Server releases such as 2012 R2, 2016, 2019, 2022 and 2025. The flaw is present on both x86, x64 and arm64 architectures where the Bluetooth Port Driver is installed.

The CVSS score of 7.1 indicates medium‑to‑high severity, but the EPSS score is not available, giving no precise estimate of current exploitation frequency. The vulnerability is not listed in the CISA KEV catalog, so it is not known to be actively exploited at large scale. The likely attack vector is over an adjacent network, presumably via a local Bluetooth radio or an application that interacts with the Bluetooth services. This suggests that a compromised device on the same local network or a malicious Bluetooth peripheral could initiate the exploit. Since the flaw allows arbitrary code execution, successful exploitation would give the attacker full control over the victim machine.