Intel Wireless Bluetooth: Out-of-bounds write in Ring 0 kernel driver
Summary
An out-of-bounds write in the Intel Wireless Bluetooth driver running in kernel mode (Ring 0) can be triggered by an adjacent attacker, allowing a denial of service. The CVSS 4.0 vector requires no privileges and no user interaction, and only availability is affected. The affected versions and fixed driver versions are not confirmed in the sources available to us.
Affected
- Intel Wireless Bluetooth driver for Windows (exact versions: Unknown; see Intel advisory INTEL-SA-01530)
- Systems with Intel Bluetooth hardware, typically laptops and workstations
Fixed in
- Unknown. Check Intel advisory INTEL-SA-01530 and the system manufacturer (OEM) for an updated Bluetooth driver.
Workaround
- Unknown. No official workaround was found.
- Disable Bluetooth on devices where it is not needed (recommendation, not a vendor statement).
Exploitation
- Not known to be exploited in the wild, according to OffSeq.
- No public proof of concept found at the time of research.
- CISA KEV listing: not found, not verified against the CISA catalogue.
Our recommendation
- Inventory endpoints with Intel Bluetooth hardware and driver versions.
- Apply Windows and OEM Bluetooth driver updates as soon as a fixed version is confirmed in Intel's advisory; patch CVE-2026-44382 and CVE-2026-44625 from the same Intel batch together.
- Prioritise laptops and workstations in shared spaces; servers are unlikely to be affected unless they have Intel Bluetooth hardware.
- Disable Bluetooth where it is not required.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Intel Security Advisory INTEL-SA-01530 intel.com
- OffSeq Radar: CVE-2026-42956 radar.offseq.com
- Strix AI: CVE-2026-42956 www.strix.ai
- Intel Support: Wireless driver information www.intel.com
- Intel Community: Bluetooth driver will not update community.intel.com
- Intel Support: Wireless driver updates (general) www.intel.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:13.
Original description (NVD)
Out-of-bounds write for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.