CVE-2025-58728: Windows 10 1809 Privilege Escalation Flaw

CVE-2025-58728 Overview

CVE-2025-58728 is a use-after-free vulnerability [CWE-416] in the Windows Bluetooth Service. An authorized local attacker can trigger the flaw to elevate privileges on affected systems. The issue affects a broad set of client and server Windows releases, from Windows 10 1809 through Windows 11 25H2 and from Windows Server 2019 through Windows Server 2025.

Microsoft published the advisory on October 14, 2025. Exploitation requires local access and low privileges but no user interaction. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability on the affected host.

Critical Impact
A local, authenticated attacker can elevate privileges to SYSTEM through a use-after-free condition in the Windows Bluetooth Service, enabling code execution in a highly privileged context on both Windows client and Windows Server platforms.

Affected Products

Microsoft Windows 10 (versions 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 22H2, 23H2, 24H2, 25H2)
Microsoft Windows Server 2019, Server 2022 23H2, and Server 2025

Discovery Timeline

2025-10-14 - CVE-2025-58728 published to NVD and Microsoft advisory released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58728

Vulnerability Analysis

The vulnerability resides in the Windows Bluetooth Service, a system component responsible for managing Bluetooth device discovery, pairing, and communication. The flaw is classified as a use-after-free condition [CWE-416], where memory is referenced after it has been released back to the allocator.

Exploitation is local and requires the attacker to already hold valid credentials on the target system. No user interaction is required, which makes the vulnerability suitable as a second-stage primitive after an initial foothold. A successful exploit yields elevated privileges, giving the attacker access at the level of the Bluetooth Service process.

Root Cause

Use-after-free vulnerabilities occur when a program continues to use a pointer after the underlying memory has been freed. In the Windows Bluetooth Service context, an attacker can influence the lifecycle of a service object so that a dangling reference is dereferenced during subsequent operations. Controlling the contents of the freed memory allows an attacker to hijack execution flow when the stale pointer is accessed.

Attack Vector

The attack vector is local. An authenticated user runs code that interacts with the Bluetooth Service through its supported interprocess interfaces. By sequencing requests that cause an object to be freed while another reference remains active, the attacker triggers the dangling reference and reclaims the freed slab with attacker-controlled data. When the service dereferences the stale pointer, the attacker gains code execution in the service context, achieving privilege escalation. See the Microsoft CVE-2025-58728 Advisory for vendor-supplied technical context.

Detection Methods for CVE-2025-58728

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the Bluetooth Support Service (bthserv) or related svchost.exe instances hosting Bluetooth components.
Creation of new privileged processes or scheduled tasks spawned as children of the Bluetooth Service process.
Anomalous loading of unsigned or user-writable DLLs into processes associated with Bluetooth service handling.

Detection Strategies

Monitor for user-context processes that open handles to Bluetooth service RPC or ALPC endpoints followed by process-token elevation or SYSTEM-level activity.
Baseline normal Bluetooth Service behavior and alert on repeated pair/unpair or object-creation cycles that could indicate use-after-free race attempts.
Correlate Bluetooth Service crashes with subsequent execution of tools commonly used for post-exploitation, such as credential dumpers or lateral-movement utilities.

Monitoring Recommendations

Enable Windows Event Log collection for the System and Application channels, along with Sysmon Event IDs 1 (process create), 10 (process access), and 11 (file create) targeting Bluetooth-related binaries.
Forward endpoint telemetry to a centralized analytics platform to correlate service crashes with subsequent privileged process activity across the fleet.
Track patch state of the Bluetooth Service binaries against the October 2025 Microsoft security update to identify unpatched hosts.

How to Mitigate CVE-2025-58728

Immediate Actions Required

Apply the October 2025 Microsoft security updates that address CVE-2025-58728 to all affected Windows client and Windows Server systems.
Prioritize patching on multi-user systems, jump hosts, and endpoints where non-administrative users have interactive logon rights.
Audit local account inventories and reduce the number of standard user accounts on systems that expose the Bluetooth Service.

Patch Information

Microsoft has released security updates addressing this vulnerability. Consult the Microsoft CVE-2025-58728 Advisory for the specific KB articles and cumulative updates that apply to each affected Windows and Windows Server build listed above. Deploy the updates through Windows Update, WSUS, Microsoft Intune, or your standard patch management workflow.

Workarounds

Where Bluetooth is not required, disable the Bluetooth Support Service (bthserv) and set its startup type to Disabled through the Services console or Group Policy.
Disable Bluetooth radios on servers and endpoints that do not require wireless peripherals, particularly on Windows Server systems where Bluetooth is rarely operational.
Restrict local logon rights and enforce the principle of least privilege to reduce the population of accounts capable of triggering the vulnerable code path.

bash

# Configuration example: disable the Windows Bluetooth Support Service
# Run from an elevated PowerShell prompt on affected hosts
Stop-Service -Name bthserv -Force
Set-Service -Name bthserv -StartupType Disabled

# Verify the service state
Get-Service -Name bthserv | Select-Object Name, Status, StartType