Concurrent execution using a shared resource with improper synchronization allows an authorized local user to trigger a race condition in the Microsoft Bluetooth driver. By manipulating timing of driver operations, the attacker can bypass privilege checks and elevate from a standard user account to administrative or system level. This local privilege escalation is a classic example of CWE-362.

Microsoft Windows 10 (versions 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server (2019, Server Core variant, 2022, 2025 and Server Core variant) are affected when they use the current Bluetooth driver. Both 32‑bit, 64‑bit, and ARM64 builds are listed, covering development and server environments.

The CVSS score of 7.0 signals high severity. No EPSS data is publicly available, and the vulnerability is not listed in the CISA KEV catalog, which suggests no widespread exploitation is known to date. The likely attack vector is local; an attacker with authorized access to the machine can interact with the Bluetooth stack, for example through a malicious device or targeted software, to trigger the race condition. Successful exploitation would give the attacker elevated privileges on the infected system.