{"id":"CVE-2026-88187","kind":"vulnerability","aliases":["CVE-2026-88187"],"related":[],"title":"Windows Bluetooth A2DP driver flaw lets a local user gain higher privileges","description":"Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.","summary":"A heap-based buffer overflow in the Windows Bluetooth A2DP driver can be triggered by an authorized attacker over an adjacent network. The result is privilege elevation on the affected Windows machine.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","windows"],"not_affected_if":["bluetooth-disabled","no-a2dp-devices"],"how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-88187 (sources do not give the build number)\n- Confirm whether Bluetooth audio (A2DP) is in use on the machine: unknown from the sources","fix":null,"status":"open","published_at":"2026-11-10T19:21:27+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","triaged_at":"2026-11-10T19:36:03+00:00","updated_at":"2026-11-10T19:36:03+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:36:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Bluetooth A2DP driver flaw lets a local user gain higher privileges","impact":"high","summary":"A heap-based buffer overflow in the Windows Bluetooth A2DP driver can be triggered by an authorized attacker over an adjacent network. The result is privilege elevation on the affected Windows machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","bluetooth"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated system privileges on the Windows machine","analyst_note":"Find Microsoft's advisory for CVE-2026-88187 to confirm affected Windows builds and the patch.","how_to_check":"- Check the installed Windows build against Microsoft's security update guide for CVE-2026-88187 (sources do not give the build number)\n- Confirm whether Bluetooth audio (A2DP) is in use on the machine: unknown from the sources","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["bluetooth-disabled","no-a2dp-devices"],"who_is_affected":"Windows machines with the Bluetooth A2DP driver in use, where an attacker already holds some authorized access on an adjacent network. The sources do not say which Windows versions are affected or whether the default configuration is exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4511,"output_tokens":541,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find Microsoft's advisory for CVE-2026-88187 to confirm affected Windows builds and the patch.","search":"'-2026':14A,17A '-88187':15A,18A 'a2dp':3A,32B,63C 'adjac':43B,74C 'affect':52B 'allow':65C 'attack':40B,68C 'author':39B,67C 'base':25B,57C 'bluetooth':2A,19B,31B,62C 'buffer':26B,58C 'cve':13A,16A 'driver':4A,33B,64C 'elev':49B,70C 'flaw':5A 'gain':10A 'heap':24B,56C 'heap-bas':23B,55C 'higher':11A 'infrastructur':20B 'let':6A 'local':8A 'machin':54B 'network':44B,75C 'overflow':27B,59C 'privileg':12A,48B,71C 'result':46B 'trigger':36B 'user':9A 'window':1A,21B,30B,53B,61C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Bluetooth A2DP driver in use, where an attacker already holds some authorized access on an adjacent network. The sources do not say which Windows versions are affected or whether the default configuration is exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetooth","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88187':15A,18A 'a2dp':3A 'bluetooth':2A 'cve':13A,16A 'driver':4A 'flaw':5A 'gain':10A 'higher':11A 'let':6A 'local':8A 'privileg':12A 'user':9A 'window':1A","search_b":"'a2dp':32B 'adjac':43B 'affect':52B 'attack':40B 'author':39B 'base':25B 'bluetooth':19B,31B 'buffer':26B 'driver':33B 'elev':49B 'heap':24B 'heap-bas':23B 'infrastructur':20B 'machin':54B 'network':44B 'overflow':27B 'privileg':48B 'result':46B 'trigger':36B 'window':21B,30B,53B","search_c":"'a2dp':63C 'adjac':74C 'allow':65C 'attack':68C 'author':67C 'base':57C 'bluetooth':62C 'buffer':58C 'driver':64C 'elev':70C 'heap':56C 'heap-bas':55C 'network':75C 'overflow':59C 'privileg':71C 'window':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88187","severity":null,"published_at":"2026-11-10T19:21:27+00:00","modified_at":"2026-11-10T19:21:27+00:00","first_seen_at":"2026-11-10T19:25:18+00:00","fetched_at":"2026-11-10T19:25:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}