{"id":"CVE-2026-88213","kind":"vulnerability","aliases":["CVE-2026-88213"],"related":[],"title":"Windows Bluetooth Service: numeric truncation lets a local user gain higher privileges","description":"Numeric truncation error in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.","summary":"A numeric truncation error in the Windows Bluetooth Service lets an attacker who already has a local account elevate their privileges. The sources give no more detail on the exact trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","infrastructure","windows"],"not_affected_if":["no-untrusted-local-users"],"how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build listed in Microsoft's advisory for CVE-2026-88213","fix":null,"status":"open","published_at":"2026-11-10T19:21:27+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:38:43+00:00","updated_at":"2026-11-10T19:38:43+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:38:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Bluetooth Service: numeric truncation lets a local user gain higher privileges","impact":"high","summary":"A numeric truncation error in the Windows Bluetooth Service lets an attacker who already has a local account elevate their privileges. The sources give no more detail on the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","bluetooth"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user gains SYSTEM-level privileges on the Windows machine.","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-88213 for affected builds and the fixed update.","how_to_check":"- Check the Windows build with `winver` and compare it against the fixed build listed in Microsoft's advisory for CVE-2026-88213\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-local-users"],"who_is_affected":"Windows machines with the Bluetooth Service present can be affected, and the attacker must already be authorized on the machine. Systems without the Bluetooth Service or with no local untrusted users are lower risk. The sources do not give affected builds.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4492,"output_tokens":485,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Response Center entry for CVE-2026-88213 for affected builds and the fixed update.","search":"'-2026':14A,17A '-88213':15A,18A 'account':39B 'allow':60C 'alreadi':35B 'attack':33B,63C 'author':62C 'bluetooth':2A,19B,29B,58C 'cve':13A,16A 'detail':48B 'elev':40B,65C 'error':25B,55C 'exact':51B 'gain':10A 'give':45B 'higher':11A 'infrastructur':20B 'let':6A,31B 'local':8A,38B,67C 'numer':4A,23B,53C 'privileg':12A,42B,66C 'servic':3A,30B,59C 'sourc':44B 'trigger':52B 'truncat':5A,24B,54C 'user':9A 'window':1A,21B,28B,57C","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Bluetooth Service present can be affected, and the attacker must already be authorized on the machine. Systems without the Bluetooth Service or with no local untrusted users are lower risk. The sources do not give affected builds.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bluetooth","high","infrastructure","windows"],"campaign_type":null,"search_a":"'-2026':14A,17A '-88213':15A,18A 'bluetooth':2A 'cve':13A,16A 'gain':10A 'higher':11A 'let':6A 'local':8A 'numer':4A 'privileg':12A 'servic':3A 'truncat':5A 'user':9A 'window':1A","search_b":"'account':39B 'alreadi':35B 'attack':33B 'bluetooth':19B,29B 'detail':48B 'elev':40B 'error':25B 'exact':51B 'give':45B 'infrastructur':20B 'let':31B 'local':38B 'numer':23B 'privileg':42B 'servic':30B 'sourc':44B 'trigger':52B 'truncat':24B 'window':21B,28B","search_c":"'allow':60C 'attack':63C 'author':62C 'bluetooth':58C 'elev':65C 'error':55C 'local':67C 'numer':53C 'privileg':66C 'servic':59C 'truncat':54C 'window':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88213","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88213","severity":null,"published_at":"2026-11-10T19:21:27+00:00","modified_at":"2026-11-10T19:21:28+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}