CVE-2025-27490 - Windows Bluetooth Service Elevation of Privilege Vulnerability

HIGH

Windows Bluetooth Service Elevation of Privilege Vulnerability

Published Apr 8, 2025

7.8

HIGH

CVSS 3.1

EPSS 0.60%

Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

Vendor Microsoft Product Windows 10 Version 21H2 Default
unknown
Affected
- ≥ 10.0.19044.0, < 10.0.19044.5737
Vendor Microsoft Product Windows 10 Version 22H2 Default
unknown
Affected
- ≥ 10.0.19045.0, < 10.0.19045.5737
Vendor Microsoft Product Windows 11 Version 23H2 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.5189
Vendor Microsoft Product Windows 11 Version 24H2 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.3775
Vendor Microsoft Product Windows 11 version 22H2 Default
unknown
Affected
- ≥ 10.0.22621.0, < 10.0.22621.5189
Vendor Microsoft Product Windows 11 version 22H3 Default
unknown
Affected
- ≥ 10.0.22631.0, < 10.0.22631.5189
Vendor Microsoft Product Windows Server 2022 Default
unknown
Affected
- ≥ 10.0.20348.0, < 10.0.20348.3453
Vendor Microsoft Product Windows Server 2022, 23H2 Edition (Server Core installation) Default
unknown
Affected
- ≥ 10.0.25398.0, < 10.0.25398.1551
Vendor Microsoft Product Windows Server 2025 Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.3775
Vendor Microsoft Product Windows Server 2025 (Server Core installation) Default
unknown
Affected
- ≥ 10.0.26100.0, < 10.0.26100.3775

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Microsoft	Windows 10 Version 21H2	unknown	Affected ≥ 10.0.19044.0, < 10.0.19044.5737
Microsoft	Windows 10 Version 22H2	unknown	Affected ≥ 10.0.19045.0, < 10.0.19045.5737
Microsoft	Windows 11 Version 23H2	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.5189
Microsoft	Windows 11 Version 24H2	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.3775
Microsoft	Windows 11 version 22H2	unknown	Affected ≥ 10.0.22621.0, < 10.0.22621.5189
Microsoft	Windows 11 version 22H3	unknown	Affected ≥ 10.0.22631.0, < 10.0.22631.5189
Microsoft	Windows Server 2022	unknown	Affected ≥ 10.0.20348.0, < 10.0.20348.3453
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	unknown	Affected ≥ 10.0.25398.0, < 10.0.25398.1551
Microsoft	Windows Server 2025	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.3775
Microsoft	Windows Server 2025 (Server Core installation)	unknown	Affected ≥ 10.0.26100.0, < 10.0.26100.3775

No remediation recorded yet.

Weaknesses (2)

CWE-122

CWE-125

Out-of-bounds Read

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-10162		Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-27490		vendor-advisorypatchVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner microsoft

Published Apr 8, 2025

Updated Aug 10, 2026

Reserved Feb 26, 2025

CISA Vulnrichment

Updated Apr 8, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner microsoft

Published Apr 8, 2025

Updated Aug 10, 2026

GitHub

No data