CVE-2025-27490: Windows 10 21h2 Privilege Escalation Flaw

CVE-2025-27490 Overview

CVE-2025-27490 is a heap-based buffer overflow vulnerability in the Windows Bluetooth Service. An authorized local attacker can exploit the flaw to elevate privileges on affected Windows client and server operating systems. Microsoft published the advisory on April 8, 2025, and the issue is tracked under CWE-122 (Heap-based Buffer Overflow). Exploitation requires local access and low-privileged authentication, but no user interaction. Successful exploitation results in high impact to confidentiality, integrity, and availability on the target host.

Critical Impact
A local, low-privileged attacker can corrupt heap memory in the Windows Bluetooth Service to elevate privileges and gain full control over the affected system.

Affected Products

Microsoft Windows 10 (21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2022, Server 2022 23H2, and Server 2025

Discovery Timeline

2025-04-08 - CVE-2025-27490 published to NVD and Microsoft security update released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27490

Vulnerability Analysis

The vulnerability resides in the Windows Bluetooth Service, a system-level component that manages Bluetooth device discovery, pairing, and data exchange. A heap-based buffer overflow condition allows an authenticated local attacker to write beyond the bounds of a heap-allocated buffer. Because the Bluetooth Service runs with elevated privileges, memory corruption inside the service can be leveraged to execute code in a higher-privileged security context. The result is local privilege escalation from a standard user account to SYSTEM-level rights on the affected host.

Root Cause

The defect is classified under CWE-122, Heap-based Buffer Overflow. The Windows Bluetooth Service fails to correctly validate the size of attacker-controlled input before copying it into a heap buffer. When the input exceeds the allocated region, adjacent heap metadata or object pointers are overwritten. Microsoft has not published detailed internals for the affected function. Refer to the Microsoft Security Update Guide for authoritative fix details.

Attack Vector

Exploitation requires local access to the target system with valid low-privileged credentials. No user interaction is needed. An attacker sends crafted data to the Bluetooth Service through its exposed local interfaces to trigger the overflow. Because the attack vector is local, the vulnerability is most relevant on multi-user workstations, terminal servers, and endpoints already compromised at a lower privilege level. Chaining this flaw with an initial access vulnerability enables an adversary to escalate to SYSTEM.

Detection Methods for CVE-2025-27490

Indicators of Compromise

Unexpected crashes or Windows Error Reporting entries for bthserv.dll or the BluetoothUserService on affected builds.
Creation of new privileged processes or services immediately following Bluetooth Service activity in the event log.
Loading of unsigned or unusual modules into the Bluetooth Service process (svchost.exe hosting bthserv).

Detection Strategies

Monitor for anomalous child processes spawned by svchost.exe instances hosting the Bluetooth Service.
Alert on token manipulation or process integrity level changes originating from Bluetooth-related services.
Correlate local logon events with sudden privilege escalation to SYSTEM on endpoints with active Bluetooth stacks.

Monitoring Recommendations

Enable and forward Windows Security, System, and Application Error logs to a centralized SIEM for correlation.
Track patch compliance for all endpoints running Windows 10, Windows 11, and Windows Server 2022/2025.
Baseline normal Bluetooth Service behavior and alert on deviations such as repeated service restarts or heap corruption crash signatures.

How to Mitigate CVE-2025-27490

Immediate Actions Required

Apply the April 2025 Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows editions.
Prioritize patching on shared workstations, jump hosts, and any system where untrusted users hold interactive logon rights.
Audit local account privileges and remove unnecessary interactive logon access to reduce the attacker pool.

Patch Information

Microsoft addressed CVE-2025-27490 in the April 8, 2025 security update cycle. Fixes are available for Windows 10 21H2 and 22H2, Windows 11 22H2, 23H2, and 24H2, and Windows Server 2022, Server 2022 23H2, and Server 2025. Consult the Microsoft Security Update Guide for the specific KB article numbers matching each supported build.

Workarounds

Disable the Windows Bluetooth Support Service (bthserv) on systems where Bluetooth is not required.
Remove or disable Bluetooth radios in firmware or device manager on servers and fixed-function endpoints.
Enforce least-privilege policies and restrict local logon rights on high-value systems until patches are deployed.

bash

# Configuration example: disable the Bluetooth Support Service on systems that do not require it
sc.exe config bthserv start= disabled
sc.exe stop bthserv