Windows Bluetooth Port Driver: Remote code execution via adjacent network

Summary

A flaw (out-of-bounds read) in the Windows Bluetooth Port Driver allows an unauthorized attacker to execute code. The attacker must be within Bluetooth radio range (adjacent network) and the victim must perform a user action, so the flaw is not internet-exposed. The affected driver is present on Windows systems with the Bluetooth stack, even without a paired device.

Affected

• Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 to < 6.3.9600.23470)
• Windows Server 2016 incl. Server Core (10.0.14393.0 to < 10.0.14393.9612)
• Windows Server 2019 (10.0.17763.0 to < 10.0.17763.9376)

Fixed in

• Fixed builds per the CNA record (to be confirmed on the MSRC page): see the build numbers above, i.e. 10.0.14393.9612 or later for Windows 10 1607 and Server 2016
• KB numbers: Unknown. Take them from the MSRC page.
• Third-party trackers show conflicting fixed builds for some releases; use the MSRC page as the reference.

Workaround

• No official Microsoft workaround is confirmed in the sources.
• Interim measure (third-party summary, not a Microsoft procedure): disable Bluetooth services and the Bluetooth Port Driver on systems that do not need Bluetooth. Check the MSRC FAQ before applying it.
• Where Bluetooth is needed, disable it on machines that do not use it and restrict pairing via settings or policy.

Exploitation

• Publicly disclosed: No.
• Exploited: No at publication (Microsoft exploitability table).
• Exploit code maturity: Unproven.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS: 0.00469.
• No public proof of concept or in-the-wild exploitation found at the time of research (point-in-time check).

Our recommendation

• Patch Windows 10 1607 and Server 2016 systems first, after confirming the fixed build and KB number on the MSRC page.
• Verify that 1607 and other affected systems are still supported by Microsoft. Isolate, disable Bluetooth on, or replace unsupported systems.
• Disable Bluetooth on laptops, mobile devices and shared meeting-room systems that do not need it, and restrict pairing.
• Patch the remaining affected Windows releases in the normal update cycle.
• Re-check CISA KEV and vendor updates for changes in exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-70126 msrc.microsoft.com
• Vulners CVE List record CVE-2026-70126 (CNA mirror) vulners.com
• Vulners NVD record CVE-2026-70126 vulners.com
• OpenCVE CVE-2026-70126 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 14:24.