CVE-2025-59289CWE-415

Windows Bluetooth Service Elevation of Privilege Vulnerability

High · published October 14, 2025

CVSS v3.1
7.0
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

⚡ A double free vulnerability in the Windows Bluetooth Service could let an attacker elevate their privileges locally — a sneaky way to gain control without a magic wand! Think of it like a hotel that accidentally gives out two master keys for the same room. One person could get in while the staff thinks it’s all secure, leading to a major breach of privacy. An attacker with local access could exploit this vulnerability to gain administrative rights, allowing them to install malware or tamper with system settings. It's like handing over the keys to your entire digital castle — absolutely devastating if you’re not careful!

Put simply

Think of it like a hotel that accidentally gives out two master keys for the same room. One person could get in while the staff thinks it’s all secure, leading to a major breach of privacy. This vulnerability occurs due to improper memory management, where the Bluetooth Service incorrectly frees memory allocation, allowing attackers to manipulate the memory structure and elevate their privileges locally.

What to do

An attacker with local access could exploit this vulnerability to gain administrative rights, allowing them to install malware or tamper with system settings. It's like handing over the keys to your entire digital castle — absolutely devastating if you’re not careful! To protect your systems, ensure your Windows Bluetooth Service is updated to the latest version and monitor user access. Regularly audit user permissions to minimize the risk of local privilege escalation. You've got this! Apply the updates and tighten your security — your system will be safer in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-415 · Double Free
Published
2025-10-14T17:01Z
EPSS history
Timeline
  • 14 OCT 17:01Z
    Windows Bluetooth Service Elevation of Privilege Vulnerability
    cvelistv5