Windows 10 1607: Heap-based buffer overflow in Bluetooth Port Driver

Summary

A heap-based buffer overflow in the Windows Bluetooth Port Driver of Windows 10 Version 1607 (LTSB 2016) allows a local attacker with low privileges to elevate their privileges to a higher level. Successful exploitation can lead to a full compromise of confidentiality, integrity and availability on the affected device. An attacker first needs a local, authenticated foothold, so the risk is mainly a second-stage threat.

Affected

• Windows 10 Version 1607 (LTSB 2016): builds 10.0.14393.0 up to, but not including, 10.0.14393.9612
• Windows Server 2016 (including Server Core) shares the same affected build range

Fixed in

• Build 10.0.14393.9612 or later, via the October 2026 update KB5126868 (released 13 October 2026)
• Microsoft's release information lists 14393.9615 as the latest 2016 LTSB build and a 2026-10 out-of-band ESU update; the contents of the out-of-band build were not verified

Workaround

• Unknown. No vendor-documented workaround was found.
• General risk reduction, not vendor-documented: disable Bluetooth where it is not needed, restrict local interactive logon on shared or fixed-function devices, and limit local user rights.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• EPSS is about 0.0028, indicating a low predicted exploitation probability.
• No public proof-of-concept was found in the searches performed; this does not rule one out.
• No exploitation in the wild is indicated in the sources reviewed.

Our recommendation

• Check whether any devices still run Windows 10 Version 1607 and whether they are enrolled in Extended Security Updates (ESU). Windows 10 Enterprise LTSB 2016 reached end of standard support on 13 October 2026.
• On ESU-enrolled devices, install KB5126868 or a later update without delay, prioritising kiosks, POS terminals and HMI systems with local logon.
• On devices without ESU, the vulnerability will not be fixed; isolate them, disable Bluetooth where unused, restrict local logon and plan migration to a supported Windows release, such as Windows 11 Enterprise LTSC 2024.
• Monitor these systems for unexpected local privilege changes and new local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83827 msrc.microsoft.com
• Windows 10 1607 and Windows Server 2016 release health learn.microsoft.com
• Windows release information learn.microsoft.com
• Windows 10 Enterprise LTSB 2016 end of support and ESU 4sysops.com
• OpenCVE record CVE-2026-83827 app.opencve.io
• Vulners NVD record CVE-2026-83827 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 08:13.