---
id: "CVE-2026-95996"
page: "https://infrastack.ai/live/CVE-2026-95996"
kind: "vulnerability"
aliases: ["CVE-2026-95996"]
title: "Windows Bluetooth Port Driver: integer underflow lets an authorized user gain privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Windows 10/11 and Windows Server", "fixed": ["10.0.26100.9974", "10.0.26200.9974", "10.0.22631.7711", "10.0.19045.7846", "10.0.20348.5870", "10.0.26100.33822"], "affected": "below the November 2026 fixed builds (see fix)", "ecosystem": "microsoft"}]
ecosystems: []
tags: ["bluetooth", "infrastructure", "privilege-escalation", "windows", "windows-server"]
not_affected_if: ["patched"]
published_at: "2026-11-10T19:21:55+00:00"
first_seen_at: "2026-11-10T19:25:26+00:00"
updated_at: "2026-11-10T20:13:17+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95996", "first_seen_at": "2026-11-10T19:25:26+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-95996", "first_seen_at": "2026-11-10T20:13:17+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-95996", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95996"]}]
exploit_sources: []
---

# Windows Bluetooth Port Driver: integer underflow lets an authorized user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-95996 (this .md is for agents)

An integer underflow in the Windows Bluetooth Port Driver lets an attacker who already has authorized access raise their privileges. The description says the attack runs over a network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- microsoft:Windows 10/11 and Windows Server affected below the November 2026 fixed builds (see fix) fixed 10.0.26100.9974, 10.0.26200.9974, 10.0.22631.7711, 10.0.19045.7846, 10.0.20348.5870, 10.0.26100.33822

## How to check

Run winver or [System.Environment]::OSVersion / (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').CurrentBuildNumber plus UBR and compare to the fixed builds in the fix field. Systems below the fixed build are affected.

## Fix

Install the November 2026 Windows cumulative update: builds at or above 10.0.14393.9688 (Win10 1607/Server 2016), 10.0.17763.9487 (1809/Server 2019), 10.0.19044.7846 / 10.0.19045.7846 (Win10 21H2/22H2), 10.0.20348.5870 (Server 2022), 10.0.22631.7711 (Win11 23H2), 10.0.26100.9974 (Win11 24H2), 10.0.26200.9974 (25H2), 10.0.26300.9974 (26H2), 10.0.28000.3501 (26H1), 10.0.26100.33822 (Server 2025). Confirm against the MSRC entry.

## Timeline

- 2026-11-10T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95996
- 2026-11-10T20:13:17+00:00 analyst https://app.opencve.io/cve/CVE-2026-95996 — MSRC page is JS-only and unreadable; builds/fixed versions taken from the Microsoft CNA record as mirrored by OpenCVE, so nothing marked verified. Vector AV:N/PR:L is per CNA; MSRC text not read to confirm network path. No exploitation or PoC found.

## Documents

- [describes] OpenCVE: CVE-2026-95996 (mirrors Microsoft CNA record) https://app.opencve.io/cve/CVE-2026-95996
- [mentions] MSRC Security Update Guide: CVE-2026-95996 (JS-only, content not readable) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-95996

## From the sources

Integer underflow (wrap or wraparound) in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_