An integer underflow (wrap or wraparound) in the Microsoft Bluetooth Driver lets an authorized attacker raise their privilege level on a neighboring networked system. The flaw occurs when the driver miscalculates packet data, enabling the attacker to obtain higher privileges on the target machine. The primary impact is privilege escalation, allowing further malicious activities on the host.

Affected are Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. All architectures—x86, x64, ARM64, and Core installations—are impacted as indicated by the CPE data.

The CVSS score of 8 indicates high severity. EPSS is not available, so exploitation probability is presently unspecified. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation. Exploitation requires an attacker with authorized or local access to an adjacent network segment; by manipulating Bluetooth packets to trigger the underflow, the attacker can elevate privileges on the affected system.