CVE-2026-42975: Windows 10 1607 Buffer Overflow Flaw

CVE-2026-42975 Overview

CVE-2026-42975 is a heap-based buffer overflow [CWE-122] in the Windows Bluetooth Port Driver. An unauthenticated attacker within Bluetooth range can execute arbitrary code on a vulnerable system without user interaction. The flaw affects every supported Windows client and Server release, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025.

Microsoft published the advisory on July 14, 2026, and the entry was last updated on July 16, 2026. Successful exploitation yields high impact to confidentiality, integrity, and availability, and can result in kernel-level code execution given the driver context.

Critical Impact
Adjacent, unauthenticated attackers can trigger memory corruption in a kernel-mode Bluetooth driver, leading to full system compromise with no user interaction.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 builds
Microsoft Windows 11 (24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-42975 published to NVD
2026-07-14 - Microsoft published the vendor advisory for CVE-2026-42975
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-42975

Vulnerability Analysis

The vulnerability resides in the Windows Bluetooth Port Driver, the kernel-mode component that mediates communication between the Bluetooth stack and lower-layer transport drivers. A heap-based buffer overflow occurs when the driver processes attacker-controlled data received over a Bluetooth link. Because the driver runs in kernel context, successful memory corruption can grant SYSTEM-level code execution.

Exploitation is constrained to the adjacent network attack surface, meaning the attacker must be within Bluetooth radio range of the target. No privileges or user interaction are required, which lowers the barrier for opportunistic attacks in dense environments such as offices, transit hubs, and conferences.

Root Cause

The root cause is improper validation of the size or structure of inbound Bluetooth protocol data before it is copied into a heap-allocated pool buffer. When a crafted packet exceeds the expected boundaries, adjacent pool memory is overwritten, corrupting kernel structures or function pointers that can be redirected to attacker-controlled code.

Attack Vector

An attacker within Bluetooth range transmits malformed frames targeting the vulnerable code path in the Bluetooth Port Driver. The target device must have Bluetooth enabled and its radio active. No pairing or prior authentication is required. Refer to the Microsoft CVE-2026-42975 Advisory for vendor-specific technical guidance.

No public proof-of-concept exploit has been published, and Microsoft has not reported exploitation in the wild.

Detection Methods for CVE-2026-42975

Indicators of Compromise

Unexpected crashes, bugchecks, or stack traces referencing bthport.sys or related Bluetooth stack components
Kernel pool corruption events surfaced in Windows Error Reporting or minidumps shortly after Bluetooth activity
New kernel-mode threads, drivers, or persistence artifacts appearing on hosts after proximity to unknown Bluetooth devices

Detection Strategies

Monitor Event Log entries related to the Bluetooth service and driver stack for repeated fault events or driver reloads
Inspect crash dumps for faulting modules within the Bluetooth Port Driver call stack
Correlate anomalous Bluetooth pairing or connection attempts with subsequent process creation or privilege changes

Monitoring Recommendations

Enable kernel crash dump collection on endpoints with active Bluetooth radios and forward the artifacts to a central analysis pipeline
Track deployment status of the July 2026 Windows security updates across all affected client and server SKUs
Alert on Bluetooth service restarts, driver reloads, or unusual radio activity on servers that do not normally use Bluetooth

How to Mitigate CVE-2026-42975

Immediate Actions Required

Apply the July 2026 Microsoft security updates that address CVE-2026-42975 across all affected Windows client and Server versions
Disable the Bluetooth radio and the Bluetooth Support Service on systems that do not require it, particularly domain controllers and servers
Prioritize patching for mobile and laptop fleets that operate outside controlled RF environments

Patch Information

Microsoft released security updates addressing this vulnerability. See the Microsoft CVE-2026-42975 Advisory for the KB articles corresponding to each affected Windows build and architecture. Verify update installation with Get-HotFix or through your endpoint management platform.

Workarounds

Turn off Bluetooth radios via Group Policy or MDM configuration on systems that do not need wireless peripheral support
Set the Bluetooth Support Service (bthserv) startup type to Disabled where operationally acceptable
Restrict physical and RF access to sensitive systems until patches are deployed

bash

# Disable the Bluetooth Support Service on Windows hosts that do not require it
sc.exe config bthserv start= disabled
sc.exe stop bthserv

# Verify July 2026 security update installation
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10