Intel Wireless Bluetooth software for Windows: Privilege escalation via uncontrolled search path
Summary
Intel Wireless Bluetooth software for Windows contains an uncontrolled search path weakness (CWE-427) in its Ring 3 user application component. A local, authenticated and low-privileged user can exploit it with high attack complexity and active user interaction to escalate privileges. A successful attack could lead to high impact on confidentiality, integrity and availability of the vulnerable system.
Affected
- Intel Wireless Bluetooth software for Windows (exact affected versions: Unknown, see Intel advisory INTEL-SA-01530)
Fixed in
- Unknown for this CVE. Intel recommends Intel Wireless Bluetooth package 24.50.0 or later in general guidance.
- Package 24.40.0 and older will not receive further security updates after August 11, 2026 according to Intel.
Workaround
- No specific workaround known.
- Restrict local user privileges so standard users are not local administrators.
Exploitation
- Not listed in CISA KEV at time of research.
- No public proof of concept or in-the-wild exploitation found at time of research.
Our recommendation
- Read Intel advisory INTEL-SA-01530 and record the affected and fixed versions.
- Inventory Windows endpoints with Intel Bluetooth software and their package versions.
- Deploy the fixed Intel or OEM package, prioritising devices below 24.50.0.
- Ensure standard users are not local administrators.
- Recheck NVD and KEV, as NVD analysis was still pending at publication.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01530 intel.com
- OpenCVE CVE-2026-40626 app.opencve.io
- Strix CVE-2026-40626 www.strix.ai
- Intel IT administrator guidance for Wireless Bluetooth www.intel.com
- Intel installation guide for legacy wireless products www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:25.
Original description (NVD)
Uncontrolled search path for some Intel(R) Wireless Bluetooth(R) software for Windows within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.