CVE-2026-45605 Overview
CVE-2026-45605 is a use-after-free vulnerability (CWE-416) in the Windows Bluetooth Service. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. The vulnerability requires low privileges, no user interaction, and a local attack vector. Successful exploitation results in high impact to confidentiality, integrity, and availability.
Microsoft published the advisory through its Security Update Guide. The vulnerability affects supported Windows versions that run the Bluetooth Service component.
Critical Impact
A local, authenticated attacker can leverage the use-after-free condition in the Windows Bluetooth Service to gain SYSTEM-level privileges on an affected host.
Affected Products
- Microsoft Windows (versions running the affected Bluetooth Service)
- Refer to the Microsoft Security Update Guide CVE-2026-45605 for the authoritative list of affected builds
Discovery Timeline
- 2026-06-09 - CVE-2026-45605 published to the National Vulnerability Database
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-45605
Vulnerability Analysis
The vulnerability resides in the Windows Bluetooth Service, a system component that manages Bluetooth device discovery, pairing, and communication. The flaw is a use-after-free condition [CWE-416], where the service continues to reference a memory object after that object has been freed. Operating on dangling pointers in a privileged service allows an attacker to corrupt memory state in the context of the service process.
The Windows Bluetooth Service runs with elevated privileges. Memory corruption inside this process can be steered to overwrite control data, function pointers, or object virtual tables. An attacker who controls the freed allocation can substitute a crafted object and influence execution paths reached through the dangling reference.
Exploitation requires local access and low-privileged authenticated context. No user interaction is required. The scope is unchanged, meaning the impact is confined to the vulnerable component, yet that component already runs at a higher privilege level than the attacker.
Root Cause
The root cause is improper object lifetime management within the Bluetooth Service. A code path releases a heap-allocated structure while another path retains a reference to it. Subsequent operations on the stale pointer dereference attacker-controllable memory.
Attack Vector
An authenticated local user invokes Bluetooth Service interfaces to trigger the vulnerable code path. The attacker races or sequences requests so a freed object is reused before reallocation, then sprays the heap to place controlled data at the reclaimed address. The resulting memory corruption is converted into arbitrary code execution within the service, yielding privilege escalation.
No verified public proof-of-concept code is available at the time of writing. Technical details are limited to the vendor advisory; see the Microsoft Security Update Guide CVE-2026-45605 for additional context.
Detection Methods for CVE-2026-45605
Indicators of Compromise
- Unexpected crashes, restarts, or hangs of the bthserv Bluetooth Support Service
- Creation of new privileged processes spawned from or shortly after Bluetooth Service activity
- Unusual Bluetooth API calls or repeated pairing/discovery operations from a low-privileged user session
Detection Strategies
- Monitor Windows Error Reporting and crash dumps for faults inside Bluetooth Service modules
- Alert on token manipulation or privilege elevation events that originate from the Bluetooth Service process
- Hunt for non-administrative users invoking Bluetooth control interfaces at unusual rates
Monitoring Recommendations
- Enable Sysmon process creation and module load logging on endpoints to capture parent-child anomalies involving the Bluetooth Service
- Forward Windows Security and System event logs to a centralized analytics platform for correlation
- Track installation state of the June 2026 Microsoft security updates across the fleet to identify unpatched hosts
How to Mitigate CVE-2026-45605
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory on all affected Windows systems
- Prioritize patching on multi-user systems, jump hosts, and developer workstations where local accounts exist
- Audit local account inventories and remove unnecessary interactive logon rights
Patch Information
Microsoft has released a security update addressing CVE-2026-45605. Consult the Microsoft Security Update Guide CVE-2026-45605 for the specific KB articles, build numbers, and download links applicable to each Windows release.
Workarounds
- Disable the Bluetooth Support Service (bthserv) on systems that do not require Bluetooth functionality
- Disable Bluetooth radios in firmware or Group Policy on servers and fixed-function workstations
- Restrict local logon rights so only trusted administrators can interact with affected hosts until patches are deployed
# Disable the Bluetooth Support Service on systems that do not require it
sc.exe config bthserv start= disabled
sc.exe stop bthserv
# Verify current state
sc.exe query bthserv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
