CVE-2025-59290: Windows 10 21h2 Privilege Escalation Flaw

CVE-2025-59290 Overview

CVE-2025-59290 is a use-after-free vulnerability [CWE-416] in the Windows Bluetooth Service. An authorized local attacker can exploit the flaw to elevate privileges on affected systems. Microsoft disclosed the issue on October 14, 2025, and it impacts a broad range of supported Windows client and server releases, including Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025.

Successful exploitation grants attackers higher privileges on the target host, enabling further compromise of local resources and lateral movement primitives.

Critical Impact
Local privilege escalation to a higher integrity context via a use-after-free in the Windows Bluetooth Service, allowing full local compromise from an authenticated user account.

Affected Products

Microsoft Windows 10 (21H2, 22H2)
Microsoft Windows 11 (22H2, 23H2, 24H2)
Microsoft Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025

Discovery Timeline

2025-10-14 - CVE-2025-59290 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59290

Vulnerability Analysis

The vulnerability resides in the Windows Bluetooth Service and is classified as a use-after-free [CWE-416]. In this class of bug, code continues to reference a memory object after it has been freed. Attackers who control allocation patterns can reclaim the freed memory with attacker-influenced data before the dangling reference is dereferenced.

Exploitation requires local access and low privileges, but does not require user interaction. Because the Windows Bluetooth Service typically executes with elevated privileges, hijacking control flow inside the service yields a privilege escalation path from a standard user to a higher integrity context. All impact metrics (confidentiality, integrity, and availability) are high, consistent with full compromise of the local host.

Microsoft has not published detailed technical internals for CVE-2025-59290. Consult the Microsoft Security Update CVE-2025-59290 advisory for authoritative product and build information.

Root Cause

The defect stems from improper object lifetime management inside the Windows Bluetooth Service. A code path releases an object while another reference remains reachable, and that reference is later used without validation. Attackers who can trigger the freeing code path and subsequently reallocate the same slot with crafted contents can steer subsequent operations against controlled data.

Attack Vector

The attack vector is local. An authenticated attacker running code on the target machine interacts with the Bluetooth Service to trigger the vulnerable allocation and free sequence, then races to reclaim the freed memory. Successful exploitation replaces trusted service state with attacker-controlled data, resulting in privilege escalation. No user interaction is required beyond the attacker's own local session.

No public proof-of-concept exploit is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-59290

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting entries associated with the bthserv service or svchost.exe instances hosting Bluetooth Service components.
New or unusual child processes spawned from svchost.exe hosting the Bluetooth Service, especially processes running with SYSTEM privileges shortly after Bluetooth activity by a low-privileged user.
Standard user accounts obtaining SYSTEM-level tokens without a legitimate elevation path in the audit trail.

Detection Strategies

Monitor Windows Event Log for service crashes and abnormal termination events tied to the Bluetooth Service, correlated with local logon sessions of non-administrative users.
Deploy behavioral endpoint detection that flags token manipulation, unexpected privilege elevation, and anomalous process lineage from service host processes.
Track patch compliance across affected Windows 10, Windows 11, and Windows Server builds and alert on unpatched hosts where Bluetooth is enabled.

Monitoring Recommendations

Enable Sysmon process creation and image load logging on endpoints, with attention to modules loaded by Bluetooth Service host processes.
Baseline normal Bluetooth Service activity per host and alert on statistical deviations, including bursts of service restarts.
Forward endpoint, service, and authentication telemetry to a centralized analytics platform to correlate low-privileged local activity with subsequent privileged actions.

How to Mitigate CVE-2025-59290

Immediate Actions Required

Apply the Microsoft security updates referenced in the Microsoft Security Update CVE-2025-59290 advisory to all affected Windows 10, Windows 11, and Windows Server systems.
Prioritize patching multi-user hosts, jump servers, and virtual desktop infrastructure where multiple standard users share endpoints.
Audit local account inventories and remove unnecessary local logon rights to reduce the population of accounts that can trigger the vulnerable code path.

Patch Information

Microsoft has released security updates for all listed affected products. Refer to the Microsoft Security Update CVE-2025-59290 guide for the specific KB numbers, build numbers, and cumulative update packages that address this issue on each Windows release.

Workarounds

Disable the Windows Bluetooth Service (bthserv) on systems that do not require Bluetooth functionality, and set its startup type to Disabled via services.msc or Group Policy.
Restrict interactive local logon on servers and shared endpoints to trusted administrative personnel until patches are deployed.
Enforce application control policies to limit which binaries unprivileged users can execute, reducing the ability to run exploit tooling locally.

bash

# Disable and stop the Windows Bluetooth Service as a temporary workaround
sc.exe config bthserv start= disabled
sc.exe stop bthserv