CVE-2023-23388

This repository contains a poc for CVE-2023-23388, which is described in this series, particularly in this post. It's an LPE in the bluetooth service aka bthserv in Windows 10/11 that allows an unprivileged user to escalate to LOCAL SERVICE. This repo doesn't contain an exploit, only a poc...

CVE-2017-0781

CVE-2017-0781 PoC Overview This is an implementation of the CVE-2017-0781 Android heap overflow vulnerability described in the Blueborne whitepaper released by Armis. Further reading: https://www.armis.com/blueborne/ In the current state, this code only demonstrates the overflow and the ability o...

CVE-2026-83777

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-83739

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-83777

A heap-based buffer overflow exists in the Windows Bluetooth Service . This vulnerability allows an unauthorized attacker to elevate privileges over an adjacent network. Exploitation details and specific affected versions are not provided in the documents, but the vulnerability is associated with...

CVE-2026-83739

A use after free vulnerability in the Windows Bluetooth Service allows an unauthorized attacker to achieve Remote Code Execution (RCE) over an adjacent network. The vulnerability has a CVSS 3.1 base score of 7.5. While exploitation details are not provided in the documents, the impact includes hi...

Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...

Windows Bluetooth Service Remote Code Execution Vulnerability

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

PT-2026-112538

Name of the Vulnerable Software and Affected Versions Windows Bluetooth Service affected versions not specified Description A use after free issue in the Windows Bluetooth Service allows an unauthorized attacker to execute arbitrary code over an adjacent network, which can affect the system. Use...

PT-2026-112571

Name of the Vulnerable Software and Affected Versions Windows Bluetooth Service affected versions not specified Description A heap-based buffer overflow in the Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network. A heap-based buffer overflow...

Microsoft Windows: CVE-2026-83739: Windows Bluetooth Service Remote Code Execution Vulnerability

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-83739: Use After Free

Use after free in Windows Bluetooth Service allows an unauthorized attacker to execute code over an adjacent network...

CVE-2026-83777: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...

Microsoft Windows: CVE-2026-83777: Windows Bluetooth Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Service allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-96456

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

EUVD-2026-85186

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456

The Reachy Mini robot's Bluetooth service contains a vulnerability where it fails to validate the specific caller of a Bluetooth command. The WriteValue function in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores the device identity passed by BlueZ , instead relying on ...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

PT-2026-97279

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...