CVE-2026-45640: Windows Bluetooth Use-After-Free Flaw

CVE-2026-45640 Overview

CVE-2026-45640 is a use-after-free vulnerability [CWE-416] in the Windows Bluetooth Port Driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows system. The vulnerability requires local access and low privileges, but no user interaction. Successful exploitation grants high impact to confidentiality, integrity, and availability of the target host.

Microsoft published guidance through the Microsoft Security Update Guide. The issue affects the kernel-mode Bluetooth port driver component, making it relevant to any Windows endpoint that loads Bluetooth stack drivers.

Critical Impact
A local attacker with low privileges can trigger memory corruption in a kernel-mode Bluetooth driver and gain SYSTEM-level privileges on the affected host.

Affected Products

Microsoft Windows (Bluetooth Port Driver component)
Specific build and version details are listed in the Microsoft Security Update Guide
Endpoints with the Bluetooth stack enabled are in scope

Discovery Timeline

2026-06-09 - CVE-2026-45640 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45640

Vulnerability Analysis

The flaw is a use-after-free condition in the Windows Bluetooth Port Driver. The driver releases a kernel object while another code path retains a reference to it. Subsequent access to the dangling pointer leads to memory corruption inside kernel space.

Because the vulnerable component runs in kernel mode, controlled reuse of the freed allocation can redirect execution flow or corrupt privileged structures. An authorized local user can leverage this to escalate from a standard account to SYSTEM. The attack complexity is rated high, which indicates that exploitation depends on winning a race condition or shaping kernel allocations through specific Bluetooth I/O sequences.

The EPSS probability is 0.055% at the 17th percentile, reflecting low predicted exploitation activity at publication. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, and no public proof-of-concept code is currently available.

Root Cause

The root cause is improper lifetime management of a kernel object inside the Bluetooth port driver. The driver frees the object without invalidating all outstanding references. A second code path then dereferences the stale pointer, satisfying the classic CWE-416 pattern. The exact object and code path are not disclosed in the public advisory.

Attack Vector

Exploitation requires local access with a valid low-privileged account on the target. The attacker issues a crafted sequence of IOCTLs or device requests to the Bluetooth port driver to drive the object into a freed state while still holding a reference. The attacker then sprays kernel memory to occupy the freed allocation with attacker-controlled data. When the dangling pointer is dereferenced, the kernel acts on attacker-supplied content, enabling privilege escalation. Refer to the Microsoft Security Update Guide for vendor technical detail.

Detection Methods for CVE-2026-45640

Indicators of Compromise

Unexpected loading or restart of BTHPORT.SYS or related Bluetooth stack drivers on systems where Bluetooth is not actively used.
Kernel-mode bug check events (BSOD) referencing the Bluetooth port driver, which can indicate failed exploitation attempts.
Non-administrative processes opening handles to Bluetooth device objects followed by privilege changes on the host.

Detection Strategies

Monitor process token elevation events where a low-privileged process transitions to SYSTEM without a legitimate parent service.
Hunt for unusual DeviceIoControl activity against Bluetooth device interfaces originating from user sessions.
Correlate Windows Error Reporting crashes in Bluetooth components with subsequent suspicious activity on the same host.

Monitoring Recommendations

Enable kernel-mode crash dump collection and forward dumps to a centralized analysis pipeline.
Track installation status of the Microsoft June 2026 security updates across the fleet to identify unpatched endpoints.
Alert on Bluetooth driver loads on systems and roles where Bluetooth is not required, such as servers and virtual desktops.

How to Mitigate CVE-2026-45640

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide for CVE-2026-45640 to all affected Windows systems.
Prioritize patching on multi-user systems, shared workstations, and developer hosts where untrusted local accounts may exist.
Audit local account membership and remove unnecessary interactive logon rights for non-administrative users.

Patch Information

Microsoft addresses CVE-2026-45640 through the security update published in the Microsoft Security Update Guide on 2026-06-09. Administrators should deploy the corresponding cumulative update through Windows Update, Windows Server Update Services (WSUS), or their preferred patch management platform. Validate update installation through Get-HotFix or the update history in Settings.

Workarounds

Disable the Bluetooth service (bthserv) on systems that do not require Bluetooth functionality, which prevents the vulnerable driver path from being reached.
Restrict physical and remote interactive access to trusted administrators until patches are deployed.
Apply application control policies to block unsigned or unapproved binaries from executing on endpoints, reducing the chance of a local exploit being staged.

bash

# Disable the Windows Bluetooth Support Service on systems that do not require Bluetooth
sc.exe config bthserv start= disabled
sc.exe stop bthserv

# Verify the June 2026 security update is installed
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10