Microsoft Windows Bluetooth Port Driver: Privilege escalation via integer underflow

Summary

The Windows Bluetooth Port Driver, a kernel component, contains an integer underflow (CWE-191). According to the CVE record, an authorized attacker with a valid low-privilege account can exploit it to gain higher privileges, without user interaction. The CVSS vector lists a network attack vector (AV:N), but this is unverified because the Microsoft advisory page could not be retrieved, and Bluetooth attacks are normally adjacent-range.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): 10.0.14393.0 to before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): 10.0.17763.0 to before 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5870

Fixed in

• Fixed builds are the first unaffected builds listed above for each product (for example 10.0.22631.7711 for Windows 11 23H2).
• KB numbers: Unknown. Check the Microsoft Security Update Guide.

Workaround

Unknown. Microsoft's mitigation guidance could not be retrieved.

• Disabling Bluetooth on devices where it is not needed reduces exposure. This is a general measure and is not confirmed by Microsoft for this CVE.

Exploitation

• Unknown. No public proof of concept or exploitation was found at the time of research.
• The CVE is not listed in the CISA Known Exploited Vulnerabilities catalogue as of the research date.

Our recommendation

• Install the next cumulative Windows update that contains the fix on all affected Windows endpoints and servers.
• Prioritise laptops and shared workstations with Bluetooth enabled; servers normally do not need Bluetooth.
• Disable Bluetooth on devices where it is not required, until the update is installed.
• Restrict local low-privilege accounts and monitor for unexpected privilege changes.
• Re-check the MSRC advisory and NVD once analysis is complete, as the record is still awaiting analysis and the attack vector is unconfirmed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-95996 msrc.microsoft.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 20:53.