23126 matches found
CVE-2026-28623
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28606
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-69889
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69817
Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally...
CVE-2026-69448
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69398
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69388
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally...
CVE-2026-68849
Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally...
EUVD-2026-73997
In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28627
In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28627
In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28623
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28623
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28623
A missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java allows for local information disclosure of the Bluetooth MAC address . This vulnerability affects the UWB (Ultra-Wideband) subcomponent and is present in Android 14, 15, and 16 . Exploitation requires no add...
EUVD-2026-73970
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-28606
A logic error in AdapterService.java within the handleBondStateChanged function allows an attacker to skip pairing. This vulnerability could lead to a remote escalation of privilege without user consent and requires no additional execution privileges or user interaction. Remediation is available ...
CVE-2026-28606
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...
SUSE CVE-2026-80819
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: take rfcommmutex for the deferred setup accept rfcommsockrecvmsg completes a deferred setup by calling rfcommdlcaccept without holding any RFCOMM lock: if testandclearbitRFCOMMDEFERSETUP, &d-flags...
CVE-2026-69817
A use-after-free vulnerability in the Windows Bluetooth Port Driver allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (HIGH) , reflecting a local attack vector with high complexity , low privileges required , and no user interaction , resulti...