CVE-2026-83838: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

Microsoft Windows: CVE-2026-83827: Windows Bluetooth Port Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally...

PT-2026-112633

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver affected versions not specified Description A race condition exists in the Microsoft Bluetooth Driver. This occurs when concurrent execution using a shared resource lacks proper synchronization, allowing an authorize...

Microsoft Windows: CVE-2026-83838: Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Windows Bluetooth A2DP driver allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-81507: Out-of-bounds Read

ESF-IDF is the Espressif Internet of Things IOT Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2cmain.c and l2cutils.c does not consistently validate option lengths against the remaining received packet bytes. A...

PT-2026-112555

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver affected versions not specified Description An out-of-bounds read exists in the Microsoft Bluetooth Driver, which allows an authorized attacker to disclose sensitive information locally and affect the system. An...

PT-2026-112604

Name of the Vulnerable Software and Affected Versions Windows Bluetooth A2DP driver affected versions not specified Description An integer underflow wrap or wraparound occurs in the Bluetooth A2DP driver. This allows an authorized attacker to elevate privileges over an adjacent network, potential...

PT-2026-113092

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver affected versions not specified Description An integer underflow wrap or wraparound occurs in the driver, which allows an authorized attacker to elevate privileges over an adjacent network. Integer underflow is a...

CVE-2026-87713: Use After Free

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-83776: Out-of-bounds Read

Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack...

Microsoft Windows: CVE-2026-83868: Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally...

Microsoft Windows: CVE-2026-83760: Microsoft Bluetooth Driver Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Bluetooth Driver allows an authorized attacker to disclose information locally...

PT-2026-112570

Name of the Vulnerable Software and Affected Versions Microsoft Bluetooth Driver affected versions not specified Description An out-of-bounds read occurs in the Microsoft Bluetooth Driver, which allows an unauthorized attacker to elevate privileges through a physical attack. An out-of-bounds read...

Microsoft Windows: CVE-2026-83776: Windows Bluetooth Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack...

CVE-2026-19937: Missing Release of Resource after Effective Lifetime

The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayablemsg.c manages a static pool of CONFIGBTMESHACCESSDELAYABLEMSGCOUNT message contexts default 4 threaded onto a freectx or busyctx list. releasedelayablemsgctx returned a context to freectx only when...

PT-2026-112594

Name of the Vulnerable Software and Affected Versions Windows Bluetooth Port Driver affected versions not specified Description A heap-based buffer overflow occurs in the Windows Bluetooth Port Driver. This issue allows an authorized attacker to elevate privileges locally on the system. A...

CVE-2026-96844: Integer Underflow (Wrap or Wraparound)

Integer underflow wrap or wraparound in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network...

Microsoft Windows: CVE-2026-96844: Microsoft Bluetooth Driver Elevation of Privilege Vulnerability

Integer underflow wrap or wraparound in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent network...

PT-2026-112896

Name of the Vulnerable Software and Affected Versions Windows Bluetooth Port Driver affected versions not specified Description A use-after-free condition in the Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. Use-after-free is a memor...

CVE-2026-19938 Use-after-free of an ATT PDU buffer when signing an outgoing Bluetooth ATT Signed Write Command fails

The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails. chansend in subsys/bluetooth/host/att.c documents and every other error exit implements the contract that on failure the caller retains ownership of the netbuf; the BTATTOPSIGNEDWRITECMD branch instead...