CVE-2025-53802 Overview
CVE-2025-53802 is a use-after-free vulnerability [CWE-416] in the Windows Bluetooth Service. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. Microsoft addressed the issue as part of its security update guide.
The vulnerability affects supported Windows client and server releases, including Windows 10, Windows 11, and Windows Server 2022 and 2025. Successful exploitation requires local access and low-privileged user context, but no user interaction.
Critical Impact
A local attacker with standard user rights can escalate to higher privileges by triggering a freed memory reference in the Bluetooth Service, gaining full confidentiality, integrity, and availability impact on the host.
Affected Products
- Microsoft Windows 10 (21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2022, Server 2022 23H2, and Server 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-53802 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-53802
Vulnerability Analysis
The vulnerability resides in the Windows Bluetooth Service and is classified as a use-after-free condition. The service releases a memory object while retaining a reference that is later dereferenced. An attacker who controls the timing of allocation and deallocation can reclaim the freed region with attacker-influenced data.
Exploitation requires the attacker to already hold a local account on the target. The attack complexity is high because reliable triggering depends on winning a race condition inside the Bluetooth Service. When successful, the attacker executes code in the security context of the Bluetooth Service, which runs with elevated privileges.
Microsoft has not published detailed root-cause information beyond the advisory. See the Microsoft Security Update CVE-2025-53802 for the authoritative product and build matrix.
Root Cause
The underlying defect is a lifecycle management error inside a Bluetooth Service component. Code paths free an object but continue to hold or reuse a pointer to that object. Subsequent operations dereference the stale pointer, permitting arbitrary read, write, or control-flow influence depending on how the freed slab is reallocated.
Attack Vector
The attack vector is local. A signed-in user runs code that interacts with the Bluetooth Service through its exposed IPC or device interfaces. The attacker sequences requests to force the service to free an internal object while another operation still references it, then reclaims the freed allocation before the reuse occurs.
No verified proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the vendor advisory for the technical description available at disclosure.
Detection Methods for CVE-2025-53802
Indicators of Compromise
- Unexpected crashes, restarts, or Watson error reports for the Bluetooth Support Service (bthserv) or svchost.exe instances hosting Bluetooth.
- Creation of child processes by the Bluetooth Service or processes spawned with SYSTEM-level tokens shortly after Bluetooth-related activity from a standard user session.
- Unusual loading of Bluetooth-related DLLs by non-standard user processes.
Detection Strategies
- Monitor for anomalous privilege transitions from medium-integrity user processes to high-integrity or SYSTEM contexts on Windows endpoints.
- Correlate Bluetooth Service faults in the Application and System event logs with subsequent process creation events (Event ID 4688) that indicate token elevation.
- Hunt for local privilege escalation behaviors using EDR telemetry that captures parent-child process relationships and token manipulation.
Monitoring Recommendations
- Enable Windows Defender Application Control or AppLocker to constrain what unprivileged users can execute against local services.
- Ingest Windows service crash and reliability telemetry into a SIEM to baseline normal Bluetooth Service behavior and alert on deviations.
- Track patch compliance across Windows 10, Windows 11, and Windows Server 2022/2025 fleets to identify hosts still vulnerable to CVE-2025-53802.
How to Mitigate CVE-2025-53802
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2025-53802 advisory to all affected Windows 10, Windows 11, and Windows Server hosts.
- Prioritize patching on multi-user systems, jump hosts, and VDI infrastructure where low-privileged users can execute code interactively.
- Audit local account membership and remove unnecessary interactive logon rights to reduce the population of potential attackers.
Patch Information
Microsoft has released fixes through its standard Update Guide. Administrators should install the cumulative update that corresponds to their Windows build. Consult the vendor advisory for exact KB numbers and build versions applicable to each affected product listed above.
Workarounds
- Disable the Bluetooth Support Service (bthserv) on systems that do not require Bluetooth functionality, particularly servers and non-mobile endpoints.
- Remove or disable Bluetooth radios in firmware or through Group Policy on hosts where the capability is unnecessary.
- Restrict local logon rights on high-value systems until the security update is deployed.
# Disable and stop the Bluetooth Support Service on hosts that do not need it
sc.exe config bthserv start= disabled
sc.exe stop bthserv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
