---
id: "CVE-2026-88213"
page: "https://infrastack.ai/live/CVE-2026-88213"
kind: "vulnerability"
aliases: ["CVE-2026-88213"]
title: "Windows Bluetooth Service: numeric truncation lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "windows-bluetooth-service", "fixed": ["10.0.19045.7846"], "affected": "< 10.0.19045.7846", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bluetooth", "infrastructure", "local-privilege-escalation", "windows"]
not_affected_if: ["no-untrusted-local-users"]
published_at: "2026-11-10T19:21:27+00:00"
first_seen_at: "2026-11-10T19:25:19+00:00"
updated_at: "2026-11-10T20:48:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-88213", "first_seen_at": "2026-11-10T19:25:19+00:00"}, {"source": "analyst", "url": "https://vulners.com/mscve/MS:CVE-2026-88213", "first_seen_at": "2026-11-10T20:48:13+00:00", "cites": ["https://vulners.com/mscve/MS:CVE-2026-88213"]}]
exploit_sources: []
---

# Windows Bluetooth Service: numeric truncation lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-88213 (this .md is for agents)

A numeric truncation error in the Windows Bluetooth Service lets an attacker who already has a local account elevate their privileges. The sources give no more detail on the exact trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:windows-bluetooth-service affected < 10.0.19045.7846 fixed 10.0.19045.7846

## How to check

Run winver (or [System.Environment]::OSVersion / Get-ComputerInfo) and compare the OS build with the fixed builds in the Fix field: 17763 < 9487, 19044/19045 < 7846, 20348 < 5870, 22631 < 7711, 26100 < 9911 (hotpatch) or 33822 (Server 2025). A lower build is exposed. Only matters where untrusted local accounts can log on.

## Fix

Install the November 10, 2026 Windows cumulative update for your version (per Vulners mirror of MSRC, not verified on MSRC): Windows 10 22H2/21H2 KB5131096 (19045.7846 / 19044.7846); Windows 11 23H2 KB5131087 (22631.7711); Windows 11 24H2/Server 2025 KB5131080 (26100.33822); Server 2022 KB5131090 (20348.5870); Server 2019/Win10 1809 KB5131085 (17763.9487). Hotpatch builds: KB5131077 (26100.33730), KB5132043 (26x00.9911). Confirm the exact build for your edition in the MSRC entry.

## Timeline

- 2026-11-10T19:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-88213
- 2026-11-10T20:48:13+00:00 analyst https://vulners.com/mscve/MS:CVE-2026-88213 — MSRC page is JS-only and web-cli/WebFetch returned nothing for it; NVD page empty. Fixed builds taken from Vulners mirror of MSRC (linked), so nothing marked verified. Not exploited per sources; no PoC found. Exa search worked; X not checked (noise unlikely for fresh CVE). Per-edition ranges in the product row are only given for Win10 22H2; add rest after reading MSRC.

## Documents

- [describes] Vulners mirror of MSRC: CVE-2026-88213 Windows Bluetooth Service EoP https://vulners.com/mscve/MS:CVE-2026-88213

## From the sources

Numeric truncation error in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_