Microsoft Bluetooth Driver CVE-2026-96844

Exploitation requires (1) the Microsoft Bluetooth Driver to be present and Bluetooth enabled/active on the target, (2) the attacker to be within Bluetooth radio range (AV:A adjacent, not internet-remote), and (3) pre-existing low-privilege authenticated access or presence on the adjacent network (PR:L). No user interaction is needed (UI:N). The proximity requirement and the need for prior low-level authorization are the primary limiting factors: machines with Bluetooth disabled, or isolated from untrusted proximity (e.g., datacenter servers), are not realistically exploitable. Affected builds span Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2012 through 2025 below the fixed build numbers listed in the EUVD record.

This is a credible but not emergency-level priority. The CVSS 3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact local privilege escalation that nonetheless requires physical/radio proximity: the Adjacent (AV:A) vector means the attacker must be within Bluetooth range, and PR:L confirms the attacker must already be an authenticated/authorized low-privilege user on or near the target. These two constraints meaningfully cap real-world exploitability compared to a network-remote flaw. CISA's SSVC framework reinforces a lower urgency: Exploitation is rated 'none' (no observed or public exploitation), Automatable is 'no' (it cannot be reliably mass-exploited, consistent with the proximity requirement), while Technical Impact is 'total' (matching the C:H/I:H/A:H full-SYSTEM-compromise outcome). No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a genuinely high-impact bug whose exploitation is gated by proximity and prior authenticated access, making it a patch-in-normal-cycle item for most fleets but a higher priority for shared, kiosk, or physically exposed Windows endpoints with Bluetooth enabled. NOTE: EPSS is absent from the input, so probabilistic exploitation likelihood could not be weighed.

An attacker with low-privilege authenticated access to a Windows machine (or within Bluetooth range of one) sends crafted Bluetooth data that triggers an integer underflow (CWE-191) in the Microsoft Bluetooth Driver, corrupting kernel memory to gain SYSTEM privileges. Because AV:A requires proximity and PR:L requires existing low-level access, this is a realistic post-foothold or insider/physical-proximity escalation rather than a drive-by remote attack. No public proof-of-concept or active exploitation is indicated in the available data.