{"id":"CVE-2026-95996","kind":"vulnerability","aliases":["CVE-2026-95996"],"related":[],"title":"Windows Bluetooth Port Driver: integer underflow lets an authorized user gain privileges","description":"Integer underflow (wrap or wraparound) in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges over a network.","summary":"An integer underflow in the Windows Bluetooth Port Driver lets an attacker who already has authorized access raise their privileges. The description says the attack runs over a network.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10/11 and Windows Server","fixed":["10.0.26100.9974","10.0.26200.9974","10.0.22631.7711","10.0.19045.7846","10.0.20348.5870","10.0.26100.33822"],"affected":"below the November 2026 fixed builds (see fix)","ecosystem":"microsoft"}],"ecosystems":[],"tags":["bluetooth","infrastructure","privilege-escalation","windows","windows-server"],"not_affected_if":["patched"],"how_to_check":"Run winver or [System.Environment]::OSVersion / (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion').CurrentBuildNumber plus UBR and compare to the fixed builds in the fix field. Systems below the fixed build are affected.","fix":"Install the November 2026 Windows cumulative update: builds at or above 10.0.14393.9688 (Win10 1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.19044.7846 / 10.0.19045.7846 (Win10 21H2/22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (Win11 23H2), 10.0.26100.9974 (Win11 24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.26100.33822 (Server 2025). Confirm against the MSRC entry.","status":"open","published_at":"2026-11-10T19:21:55+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","triaged_at":"2026-11-10T19:25:54+00:00","updated_at":"2026-11-10T20:13:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:25:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Bluetooth Port Driver: integer underflow lets an authorized user gain privileges","impact":"high","summary":"An integer underflow in the Windows Bluetooth Port Driver lets an attacker who already has authorized access raise their privileges. The description says the attack runs over a network.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","bluetooth"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker gains elevated privileges on the Windows machine","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-95996 for affected Windows builds, the patched version and whether a network path is really required.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Bluetooth Port Driver present are the systems to look at. The sources do not say which Windows builds are affected or which conditions are needed beyond an authorized attacker. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000661,"input_tokens":4511,"output_tokens":420,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-95996 for affected Windows builds, the patched version and whether a network path is really required.","search":"'-2026':14A,17A '-95996':15A,18A '10/11':20A 'access':49B 'allow':72C 'alreadi':46B 'and':21A 'attack':44B,57B,75C 'author':9A,48B,74C 'bluetooth':2A,24B,39B,69C 'cve':13A,16A 'descript':54B 'driver':4A,41B,71C 'elev':77C 'escal':28B 'gain':11A 'infrastructur':25B 'integ':5A,34B,62C 'let':7A,42B 'network':61B,81C 'port':3A,40B,70C 'privileg':12A,27B,52B,78C 'privilege-escal':26B 'rais':50B 'run':58B 'say':55B 'server':23A,32B 'underflow':6A,35B,63C 'user':10A 'window':1A,29B,31B,38B,68C 'windows':19A,22A 'windows-serv':30B 'wrap':64C 'wraparound':66C","nicknames":[],"mitigations":[],"who_affected":"Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2016, 2019, 2022, 2025 below the fixed builds, per the Microsoft CNA record. An attacker needs an existing low-privilege authorized account; the CVSS vector says network-reachable, which MSRC's text has not been read to confirm. Fully patched systems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["1011andwindowsserver","windows1011andwindowsserver"],"ptokens":["10","11","and","server","windows"],"labels":["bluetooth","high","infrastructure","privilegeescalation","windows","windowsserver"],"campaign_type":null,"search_a":"'-2026':14A,17A '-95996':15A,18A '10/11':20A 'and':21A 'author':9A 'bluetooth':2A 'cve':13A,16A 'driver':4A 'gain':11A 'integ':5A 'let':7A 'port':3A 'privileg':12A 'server':23A 'underflow':6A 'user':10A 'window':1A 'windows':19A,22A","search_b":"'access':49B 'alreadi':46B 'attack':44B,57B 'author':48B 'bluetooth':24B,39B 'descript':54B 'driver':41B 'escal':28B 'infrastructur':25B 'integ':34B 'let':42B 'network':61B 'port':40B 'privileg':27B,52B 'privilege-escal':26B 'rais':50B 'run':58B 'say':55B 'server':32B 'underflow':35B 'window':29B,31B,38B 'windows-serv':30B","search_c":"'allow':72C 'attack':75C 'author':74C 'bluetooth':69C 'driver':71C 'elev':77C 'integ':62C 'network':81C 'port':70C 'privileg':78C 'underflow':63C 'window':68C 'wrap':64C 'wraparound':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95996","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95996","severity":null,"published_at":"2026-11-10T19:21:55+00:00","modified_at":"2026-11-10T19:21:56+00:00","first_seen_at":"2026-11-10T19:25:26+00:00","fetched_at":"2026-11-10T19:25:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95996:2623","url":"https://app.opencve.io/cve/CVE-2026-95996","severity":null,"published_at":"2026-11-10T20:13:17+00:00","modified_at":"2026-11-10T20:13:17+00:00","first_seen_at":"2026-11-10T20:13:17+00:00","fetched_at":"2026-11-10T20:13:17+00:00","note":"MSRC page is JS-only and unreadable; builds/fixed versions taken from the Microsoft CNA record as mirrored by OpenCVE, so nothing marked verified. Vector AV:N/PR:L is per CNA; MSRC text not read to confirm network path. No exploitation or PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-95996","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95996"]}],"documents":[{"id":117803,"url":"https://app.opencve.io/cve/CVE-2026-95996","title":"OpenCVE: CVE-2026-95996 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117805,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95996","title":"MSRC Security Update Guide: CVE-2026-95996 (JS-only, content not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}