--- id: "CVE-2026-88187" page: "https://infrastack.ai/live/CVE-2026-88187" kind: "vulnerability" aliases: ["CVE-2026-88187"] title: "Windows Bluetooth A2DP driver heap overflow lets a logged-in user on an adjacent network gain higher privileges" severity: "high" cvss: 8.0 epss: null exploited: false status: "open" category: "infrastructure" products: [{"name": "Windows 10 1809 / Server 2019", "fixed": ["10.0.17763.9487"], "affected": ">= 10.0.17763.0, < 10.0.17763.9487", "ecosystem": "vendor"}, {"name": "Windows 10 21H2", "fixed": ["10.0.19044.7846"], "affected": ">= 10.0.19044.0, < 10.0.19044.7846", "ecosystem": "vendor"}, {"name": "Windows 10 22H2", "fixed": ["10.0.19045.7846"], "affected": ">= 10.0.19045.0, < 10.0.19045.7846", "ecosystem": "vendor"}, {"name": "Windows Server 2022", "fixed": ["10.0.20348.5870"], "affected": ">= 10.0.20348.0, < 10.0.20348.5870", "ecosystem": "vendor"}, {"name": "Windows 11 23H2", "fixed": ["10.0.22631.7711"], "affected": ">= 10.0.22631.0, < 10.0.22631.7711", "ecosystem": "vendor"}, {"name": "Windows 11 24H2", "fixed": ["10.0.26100.9974"], "affected": ">= 10.0.26100.0, < 10.0.26100.9974", "ecosystem": "vendor"}, {"name": "Windows Server 2025", "fixed": ["10.0.26100.33822"], "affected": ">= 10.0.26100.0, < 10.0.26100.33822", "ecosystem": "vendor"}, {"name": "Windows 11 25H2", "fixed": ["10.0.26200.9974"], "affected": ">= 10.0.26200.0, < 10.0.26200.9974", "ecosystem": "vendor"}, {"name": "Windows 11 26H1", "fixed": ["10.0.28000.3501"], "affected": ">= 10.0.28000.0, < 10.0.28000.3501", "ecosystem": "vendor"}, {"name": "Windows 11 26H2", "fixed": ["10.0.26300.9974"], "affected": ">= 10.0.26300.0, < 10.0.26300.9974", "ecosystem": "vendor"}] ecosystems: [] tags: ["a2dp", "adjacent", "bluetooth", "infrastructure", "privilege-escalation", "windows"] not_affected_if: ["bluetooth-disabled", "no-a2dp-devices", "no-bluetooth-hardware", "patched-november-2026"] published_at: "2026-11-10T19:21:27+00:00" first_seen_at: "2026-11-10T19:25:18+00:00" updated_at: "2026-11-10T21:05:28+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88187", "first_seen_at": "2026-11-10T19:25:18+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-88187", "first_seen_at": "2026-11-10T21:05:28+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-88187"]}] exploit_sources: [] --- # Windows Bluetooth A2DP driver heap overflow lets a logged-in user on an adjacent network gain higher privileges Link for people: https://infrastack.ai/live/CVE-2026-88187 (this .md is for agents) Microsoft's CVE record (CWE-122, CVSS 8.0) says a heap-based buffer overflow in the Windows Bluetooth A2DP driver lets an authorized attacker on an adjacent network elevate privileges. Fixed in the November 2026 updates. No exploitation or public PoC reported (CVSS exploit maturity: unproven). _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Windows 10 1809 / Server 2019 affected >= 10.0.17763.0, < 10.0.17763.9487 fixed 10.0.17763.9487 - vendor:Windows 10 21H2 affected >= 10.0.19044.0, < 10.0.19044.7846 fixed 10.0.19044.7846 - vendor:Windows 10 22H2 affected >= 10.0.19045.0, < 10.0.19045.7846 fixed 10.0.19045.7846 - vendor:Windows Server 2022 affected >= 10.0.20348.0, < 10.0.20348.5870 fixed 10.0.20348.5870 - vendor:Windows 11 23H2 affected >= 10.0.22631.0, < 10.0.22631.7711 fixed 10.0.22631.7711 - vendor:Windows 11 24H2 affected >= 10.0.26100.0, < 10.0.26100.9974 fixed 10.0.26100.9974 - vendor:Windows Server 2025 affected >= 10.0.26100.0, < 10.0.26100.33822 fixed 10.0.26100.33822 - vendor:Windows 11 25H2 affected >= 10.0.26200.0, < 10.0.26200.9974 fixed 10.0.26200.9974 - vendor:Windows 11 26H1 affected >= 10.0.28000.0, < 10.0.28000.3501 fixed 10.0.28000.3501 - vendor:Windows 11 26H2 affected >= 10.0.26300.0, < 10.0.26300.9974 fixed 10.0.26300.9974 ## How to check Run winver or [System.Environment]::OSVersion / (Get-ComputerInfo).OsBuildRevision and compare the full build with the fixed build for your edition (see fix). Lower means vulnerable. Machines with no Bluetooth radio or Bluetooth disabled are less likely to be reachable, but Microsoft's record gives no workaround; also check the MSRC page for the exact KB. ## Fix Install the November 2026 Windows cumulative update: Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846 (KB5131096); Server 2022 10.0.20348.5870; Win11 23H2 10.0.22631.7711; Win11 24H2 and Server 2025 builds 10.0.26100.9974 (client) / 10.0.26100.33822 (Server 2025); Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974. ## Timeline - 2026-11-10T19:25:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88187 - 2026-11-10T21:05:28+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-88187 — Read Microsoft CNA data in the CVE record (affected builds, fixed builds); MSRC page itself returned empty, so how_to_check/who_affected not verified. Win10 22H2 fix build matches BleepingComputer KB5131096. No exploitation or PoC found. ## Documents - [advisory] CVE-2026-88187 CVE record (Microsoft CNA data; links MSRC advisory) https://cveawg.mitre.org/api/cve/CVE-2026-88187 - [fix] Windows 10 KB5131096 ESU (Nov 2026 Patch Tuesday) https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-10-kb5131096-extended-security-update/ ## From the sources Heap-based buffer overflow in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_