Vulnerabilities
CVE-2026-70126: Windows Bluetooth Port Driver RCE Exploit Enables Network‑Based Code Execution
An out‑of‑bounds read in the Windows Bluetooth Port Driver (CVE‑2026‑70126) lets an unauthenticated attacker on the same network execute arbitrary code on a target system. The flaw is exploitable via crafted Bluetooth traffic and does not require user interaction. Microsoft has released a patch; administrators should update affected Windows 10/11 systems immediately.
What happened
An out‑of‑bounds read in the Windows Bluetooth Port Driver (CVE‑2026‑70126) enables an unauthenticated attacker to execute arbitrary code on a target machine via crafted Bluetooth traffic.
“An out-of-bounds read in the Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network.”
Impact
Systems running affected Windows 10/11 versions with the default Bluetooth stack are vulnerable. Successful exploitation grants full code execution privileges on the target machine, potentially allowing lateral movement or persistence.
Mitigation
Microsoft has released a security update that patches the driver. The update is available through Windows Update and can be applied manually via the Microsoft Update Catalog.
What to do
- Verify that the latest cumulative update for Windows 10/11 is installed.
- Force a Windows Update scan or download the patch from the Microsoft Update Catalog.
- Restart affected systems to apply the driver fix.
- Monitor Bluetooth traffic for anomalous activity and consider disabling Bluetooth on non‑essential devices.
Related vulnerabilities
CVE-2026-83827: Windows Bluetooth Port Driver Local Privilege Escalation
A heap‑based buffer overflow in the Windows Bluetooth Port Driver (CVE‑2026‑83827) lets a local attacker gain elevated privileges. The flaw affects all Windows systems with the Bluetooth driver enabled. Defenders should apply the latest Microsoft patch, disable Bluetooth when not needed, and monitor for suspicious local activity.
Read briefing
CVE-2026-102856: Visio RCE via Heap Overflow
A heap-based buffer overflow vulnerability exists in Microsoft Visio. Successful exploitation allows a remote, unauthenticated attacker to achieve arbitrary code execution. Defenders should prioritize patching Visio installations.
Read briefing
CVE-2026-69639: Windows libarchive Heap Overflow Enables Remote Code Execution
A heap-based buffer overflow in Windows Libarchive (CVE‑2026‑69639) permits unauthenticated network attackers to execute arbitrary code. The flaw affects all Windows systems that use the vulnerable libarchive component. Apply the latest Microsoft security update immediately and verify the component version.
Read briefing
CVE-2026-83748: Windows Error Reporting Remote Code Execution via Heap Overflow
A heap-based buffer overflow in Windows Error Reporting enables remote code execution by unauthenticated attackers. The flaw can be exploited over a network, allowing arbitrary code execution on affected systems. Apply the latest Microsoft security update or disable the Error Reporting service to mitigate the risk.
Read briefing