Windows Bluetooth Service: Use after free allows remote code execution

Summary

A use-after-free flaw (CWE-416) in the Windows Bluetooth Service allows an unauthorized attacker to execute code. The attacker needs to be within Bluetooth range of the affected system, which is an adjacent network attack, and no privileges or user interaction are required. Microsoft rates the severity as Important (CVSS 3.1 base score 7.5), but Microsoft and CISA SSVC assess exploitation as unlikely and no public exploit is known.

Affected

• Windows 10 Version 1809 (32-bit and x64): builds below 10.0.17763.9376
• Windows Server 2019 and Server 2019 Server Core: builds below 10.0.17763.9376
• Other affected Windows 10, Windows 11 and Windows Server 2022/2025 builds are listed in the Microsoft Security Update Guide.

Fixed in

• Windows 10 Version 1809 and Windows Server 2019: build 10.0.17763.9376 or later, via the Microsoft security update for October 2026
• Other versions: see the fixed builds in the Microsoft Security Update Guide

Workaround

Unknown.

Exploitation

• Publicly disclosed: No
• Exploited in the wild: No
• Microsoft exploitability assessment: Exploitation Unlikely
• CISA SSVC: Exploitation none, automatable no, technical impact total
• EPSS: 0.00481

Our recommendation

• Install the October 2026 Microsoft security update on all Windows 10 1809 and Windows Server 2019 systems, starting with devices in shared or public spaces where Bluetooth is used.
• Check whether any system still runs Windows 10 1809 and plan an upgrade, because a fixed build does not help if the operating system is out of support.
• Consider disabling Bluetooth on devices that do not need it (not an official Microsoft mitigation).
• Review the Microsoft Security Update Guide for the exact update and the fixed build for each Windows version in use.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83739 msrc.microsoft.com
• Vulners: CVE-2026-83739 (CNA data) vulners.com
• Vulners: NVD:CVE-2026-83739 vulners.com
• OpenCVE: CVE-2026-83739 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 18:46.