Windows Bluetooth Driver: Integer underflow allows privilege escalation

Summary

An integer underflow in the Microsoft Bluetooth driver of Windows allows an authorized attacker to elevate privileges. The attacker needs a low-privilege account on the host and Bluetooth proximity (adjacent attack vector, PR:L, UI:N). Microsoft rates the impact on confidentiality, integrity and availability as high. Microsoft marks the vulnerability as not exploited, and no public proof of concept was found.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2012 and 2012 Server Core: 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 and 2012 R2 Server Core: 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016: 10.0.14393.0 to before 10.0.14393.9612

Fixed in

• Windows 10 Version 1607: build 10.0.14393.9612
• Windows 10 Version 1809: build 10.0.17763.9376
• Windows 10 Version 21H2 and 22H2: build 10.0.19045.7807 (21H2 build 10.0.19044.7807 per CNA record)
• Windows 11 Version 23H2: build 10.0.22631.7652
• Windows 11 Version 24H2, 25H2 and 26H2: build 10.0.26100.9711 / 10.0.26200.9711 / 10.0.26300.9711
• Windows 11 Version 26H1: build 10.0.28000.3231
• Windows Server 2012 and 2012 R2: see MSRC for the fixed build
• KB numbers: Unknown. Check the MSRC Security Update Guide.

Workaround

Unknown. No interim workaround is named in the sources. Disabling Bluetooth on hosts that do not need it reduces exposure.

Exploitation

• Not exploited in the wild according to Microsoft (temporal vector E:U, exploit code maturity unproven).
• Not listed in the CISA KEV catalog. CISA SSVC: exploitation none, automatable no, technical impact total.
• No public proof of concept found in the research. This is absence of evidence, not proof that none exists.
• EPSS about 0.5 percent.

Our recommendation

• Install the Microsoft security update for the affected Windows build as soon as possible, together with the same-day Bluetooth advisories CVE-2026-83868 and CVE-2026-83838.
• Until patched, disable Bluetooth on servers and hosts that do not need it, and restrict local logon rights.
• Prioritize laptops, shared workstations and hosts with untrusted local users.
• Windows 10 Version 1607 is an old build. Verify its support status on Microsoft's lifecycle page before planning, because it may only receive updates through extended security or LTSC programs.
• Priority: medium. Raise it if a shared machine or a still-used 1607 system is affected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96844 msrc.microsoft.com
• Vulners: CVE-2026-96844 (CNA record) vulners.com
• OpenCVE: CVE-2026-96844 app.opencve.io
• Vulners: PT-2026-112633 (same-day Bluetooth advisory) vulners.com
• Vulners: MS:CVE-2026-83838 (A2DP driver integer underflow) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:23.