CVE-2025-59289: Windows 10 21h2 Privilege Escalation Flaw

CVE-2025-59289 Overview

CVE-2025-59289 is a double free vulnerability [CWE-415] in the Windows Bluetooth Service. An authenticated local attacker can exploit the flaw to elevate privileges on affected Windows client and server systems. Microsoft published the advisory on October 14, 2025, and assigned a CVSS 3.1 base score of 7.0 with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

The vulnerability affects supported releases of Windows 10, Windows 11, and Windows Server 2022 through 2025. Successful exploitation grants the attacker elevated code execution in the context of the Bluetooth Service, which runs with high privilege on the local host.

Critical Impact
Local, authenticated attackers who win a timing condition against the Windows Bluetooth Service can execute code with elevated privileges and fully compromise confidentiality, integrity, and availability on the target host.

Affected Products

Microsoft Windows 10 21H2 and 22H2
Microsoft Windows 11 22H2, 23H2, and 24H2
Microsoft Windows Server 2022, Server 2022 23H2, and Server 2025

Discovery Timeline

2025-10-14 - CVE-2025-59289 published to NVD and Microsoft security update released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59289

Vulnerability Analysis

The flaw resides in the Windows Bluetooth Service, a system component that brokers Bluetooth stack operations for user-mode clients. The service frees the same memory region twice under specific conditions, corrupting the heap allocator's internal state. An attacker who controls subsequent allocations can steer the freed chunk toward attacker-controlled data and hijack execution flow inside the privileged service process.

Exploitation requires local access and valid credentials on the target. The attack complexity is high because the attacker must win a race or reach a specific state sequence that triggers the duplicate deallocation. When the primitive is achieved, the attacker gains code execution at the privilege level of the Bluetooth Service, breaking the isolation boundary between a standard user and a privileged system component.

Root Cause

The root cause is improper lifetime management of a heap object inside the Bluetooth Service [CWE-415]. Two independent code paths release the same allocation without clearing the owning reference, producing a double free when the second path executes. Heap metadata corruption follows, enabling controlled write primitives that turn into arbitrary code execution.

Attack Vector

The attack vector is local. A low-privileged authenticated user submits crafted requests or triggers state transitions in the Bluetooth Service to force the duplicate free. No user interaction from another account is required. Because the vulnerability is in a service that ships enabled on client SKUs, the attack surface is broad on workstations and any server that enables Bluetooth support.

No public proof-of-concept exploit or in-the-wild activity has been documented, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. Refer to the Microsoft Security Update CVE-2025-59289 advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-59289

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries for the bthserv service or svchost.exe instances hosting Bluetooth.
Child processes spawned by the Bluetooth Service that do not match legitimate operational behavior.
New or modified files, scheduled tasks, or services created shortly after Bluetooth service anomalies on a host.

Detection Strategies

Monitor Windows Event Log for service crash events (Event IDs 7031, 7034) referencing bthserv or the Bluetooth User Support Service.
Correlate low-privileged user sessions with Bluetooth service faults and subsequent privileged process creation on the same host.
Baseline expected callers of Bluetooth RPC endpoints and alert on unusual clients issuing rapid or malformed requests.

Monitoring Recommendations

Enable process creation auditing (Event ID 4688) with command line logging and forward events to a central analytics platform.
Track memory-corruption exception codes such as 0xC0000374 (heap corruption) originating from Bluetooth service processes.
Alert on privilege escalation patterns where a standard user account is followed by SYSTEM-level activity on the same endpoint within a short window.

How to Mitigate CVE-2025-59289

Immediate Actions Required

Apply the October 2025 Microsoft security update referenced in the MSRC advisory to all affected Windows client and server systems.
Prioritize patch deployment on multi-user hosts, jump servers, and endpoints where untrusted local users can authenticate.
Inventory assets against the affected CPE list and confirm patch state through your endpoint management platform.

Patch Information

Microsoft addressed CVE-2025-59289 in the October 14, 2025 security updates for Windows 10 21H2/22H2, Windows 11 22H2/23H2/24H2, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Consult the Microsoft Security Update CVE-2025-59289 page for the exact KB numbers per product build.

Workarounds

Disable the Bluetooth Support Service (bthserv) on systems that do not require Bluetooth functionality, such as servers and virtual desktops.
Restrict interactive and remote logon rights so that only trusted administrators can authenticate to sensitive hosts until patching completes.
Enforce least privilege on standard user accounts and remove local administrator rights that could ease post-exploitation activity.

bash

# Configuration example: disable the Bluetooth Support Service on hosts that do not need it
sc.exe config bthserv start= disabled
sc.exe stop bthserv