EUVD-2026-99379
GHSA-cgxj-m54c-f83r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-priv foothold within Bluetooth range
-
ExploitSend crafted A2DP request to driver
-
ExecutionTrigger integer underflow in kernel
-
ImpactCorrupt memory to elevate to SYSTEM
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires the target to have the Windows Bluetooth A2DP (audio streaming) driver active and the attacker within Bluetooth/adjacent-network range (AV:A). The attacker must already hold low-level authorized access on the host (PR:L) - this is not remote unauthenticated exploitation. No user interaction is needed (UI:N). Limiting factors that reduce real-world exploitability: physical/radio proximity to the victim, an existing low-privilege foothold, and Bluetooth being enabled; hosts with Bluetooth disabled or out of range are not exposed. Affected builds are the pre-patch versions listed in EUVD across Windows 10/11 (through 26H2) and Windows Server 2016-2025. |
| Impact | The provided CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yields a base score of 8.0 (High) with total CIA impact, consistent with the SSVC 'Technical Impact: total' rating. However, the exploitation-enabling signals are weak: SSVC reports Exploitation 'none' and Automatable 'no', there is no CISA KEV listing, and no EPSS score or public POC was provided - so this is a serious-but-not-urgent issue rather than an actively-exploited priority. The two key constraints that lower real-world risk are AV:A (the attacker must be on an adjacent/Bluetooth-range network, not remote over the internet) and PR:L (the attacker already needs some authorized access on the host), which together make broad opportunistic exploitation unlikely and favor targeted or chained scenarios. Note a conflict between the input tag 'Information Disclosure' and the description, which explicitly states elevation of privilege; the CVSS impact (I:H/A:H, not just C:H) and CWE-191 support an EoP/memory-corruption classification, so treat the 'Information Disclosure' label as suspect. EPSS data is absent, so probabilistic exploitation likelihood could not be independently weighed. |
| Exploit ScenarioDerived | An attacker with low-level authorized access to a Windows host, positioned within Bluetooth range, pairs or interacts with the target's A2DP (audio streaming) stack and sends a crafted request that triggers an integer underflow (CWE-191) in the Bluetooth A2DP driver. The resulting kernel memory corruption lets the attacker elevate from a low-privileged context to SYSTEM. No public exploit code or active exploitation has been identified at time of analysis, and the adjacent-network (AV:A) requirement limits this to attackers already in physical/radio proximity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in the Windows Bluetooth A2DP audio-streaming driver allows an attacker who already holds low-privilege authorized access on a host - and who is within Bluetooth radio range - to induce an integer underflow in driver arithmetic and leverage the resulting memory-handling error to gain elevated rights, with high impact across confidentiality, integrity, and availability. The 8.0 High severity rating (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is consistent with the CISA SSVC assessment of 'total' technical impact, and reflects two important constraints: the attack vector is adjacent-network only and the attacker must already have a foothold on the target, so this is not remote unauthenticated exploitation, and no user interaction is required. Microsoft has released updates through the MSRC update guide, CISA's SSVC exploitation value is 'none', and no public exploit code was identified at time of analysis. Unpatched Windows 10, Windows 11 (through 26H2), and Windows Server 2016 through 2025 builds are affected, but only hosts with Bluetooth enabled and within radio proximity of the attacker are exposed.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-83838 from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83838, bringing each affected branch to its listed fixed build - 10.0.14393.9612 (Windows 10 1607 / Server 2016), 10.0.17763.9376 (Windows 10 1809 / Server 2019), 10.0.19044.7807 (Windows 10 21H2/22H2), 10.0.22631.7652 (Windows 11 23H2), 10.0.26100.9711 (Windows 11 24H2) or 10.0.26100.33650 (Server 2025), 10.0.26200.9711 (Windows 11 25H2), 10.0.28000.3231 (Windows 11 26H1), 10.0.26300.9711 (Windows 11 26H2), and 10.0.20348.5761 (Server 2022). Because the attacker needs both an existing low-privilege foothold and Bluetooth radio proximity, the strongest interim mitigations are exposure reductions rather than code-level workarounds: disable the Bluetooth radio or the Bluetooth audio/A2DP service on hosts that do not require wireless audio (side effect: loss of all Bluetooth peripherals, not just audio), and where Bluetooth must stay enabled, restrict physical and radio access to the host - shielded rooms, transmit-power reduction, or removal of Bluetooth from high-value kiosks and reception-area machines - since the profile cannot be patched by configuration alone. Reducing the population of low-privilege interactive accounts and tightening local logon rights shrinks the PR:L prerequisite, and disabling unused Bluetooth hardware via device policy also removes the attack surface; none of these controls detect an in-progress exploit, so pair them with driver-level crash telemetry and monitoring of unexpected Bluetooth audio stack faults on hosts that must keep Bluetooth active. No vendor-released patch version beyond the advisory-linked builds should be assumed, and no public exploit code was identified at time of analysis, so prioritization should follow normal Microsoft Patch Tuesday cadence with elevated attention to Bluetooth-enabled endpoints in physically accessible locations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Advanced Audio Distribution Profile (A2DP) is the Bluetooth profile used to stream stereo audio to headsets and speakers, and it is implemented in Windows through the Bluetooth audio driver stack that processes A2DP signaling and media payloads received over the air. The assigned root-cause class is CWE-191 (Integer Underflow / Wraparound): a length, offset, or counter derived from attacker-influenced input is decremented or subtracted past zero and wraps to a very large value, which typically produces an undersized allocation or an out-of-bounds access, and in a driver context such memory corruption can be redirected into an elevation of privilege. The CVSS vector's AV:A reflects that the malicious A2DP traffic arrives over the Bluetooth radio interface (adjacency rather than a routable network path), PR:L reflects the requirement for an existing low-privilege authorized session on the host, and AC:L/UI:N indicate no special timing race or victim interaction is needed once those prerequisites are met. The accompanying metadata tags classify the flaw under Integer Overflow and also reference Information Disclosure, but the authoritative description, CWE, and vector all point to a memory-safety defect exploited for privilege elevation rather than a pure information leak. Note that the EUVD affected-version data lists two different fixed thresholds for build 10.0.26100 depending on the product branch (Windows 11 Version 24H2 versus Windows Server 2025), which is characteristic of separate servicing branches for the same base build.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Bluetooth proximity gives AV:A; a low-priv local foothold is required so PR:L; no user interaction and kernel compromise yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer underflow (wrap or wraparound) in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network.
Executive ViewAI
Microsoft Windows Bluetooth A2DP audio-streaming driver contains a high-severity privilege-escalation flaw that could let an attacker with an existing low-privilege foothold and Bluetooth radio proximity gain elevated rights on affected Windows 10, Windows 11 (through 26H2), and applicable Windows Server systems. Because the flaw can affect confidentiality, integrity, and availability, a successful exploit could turn a limited user account into a more powerful foothold, increasing risk of lateral movement and data compromise across the organization. Vendor patches are available, and no public exploit identified at time of analysis, but leadership should prioritize remediation for Bluetooth-enabled endpoints and servers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB