The vulnerability is a use‑after‑free in the Windows Bluetooth Port Driver that lets an attacker on an adjacent network elevate privileges on the target system, potentially enabling the execution of arbitrary code with higher privileges. This flaw is categorized as CWE‑416: Use After Free and could lead to full system compromise if exploited.

Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server 2016, 2019, 2022, 2025 (standard and core installations) are affected, as all these versions include the vulnerable Bluetooth Port Driver.

The CVSS score of 7.5 indicates a high severity. No EPSS score is published, and the flaw is not listed in CISA’s KEV catalog, so quantified exploit probability is unavailable. The attack vector is inferred to be network‑based, requiring the attacker to be on a device capable of communicating with the target’s Bluetooth subsystem. Because the flaw allows privilege escalation, it poses a significant risk to confidentiality, integrity, and availability of affected systems.