Vulnerabilities ›

CVE-2026-23671

High

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.

CWE-362 — Weakness Type

                    Published: Mar 10, 2026                      ·  Modified: Mar 17, 2026                      ·  Source: NVD                

CVSS v3

7.0

🔗 NVD Official

📄 Description (English)

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.

🤖 AI Executive Summary

A race condition vulnerability in Windows Bluetooth RFCOM Protocol Driver allows authorized local attackers to escalate privileges. The flaw exists due to improper synchronization during concurrent execution of shared resources.

📄 Description (Arabic)

تتعلق الثغرة بعيب في مزامنة الموارد المشتركة في برنامج تشغيل Bluetooth RFCOM بنظام Windows. يمكن لمهاجم محلي مصرح له استغلال حالة التنافس للحصول على امتيازات إدارية.

🤖 ملخص تنفيذي (AI)

ثغرة تنافس في برنامج تشغيل بروتوكول Windows Bluetooth RFCOM تسمح للمهاجمين المصرح لهم محليًا بتصعيد الامتيازات. يحدث الخلل بسبب عدم المزامنة الصحيحة أثناء التنفيذ المتزامن للموارد المشتركة.

🤖 AI Intelligence Analysis Analyzed: May 10, 2026 10:19

🇸🇦 Saudi Arabia Impact Assessment

Saudi Relevance: high

🏢 Affected Saudi Sectors

government banking healthcare telecom

🎯 MITRE ATT&CK Techniques

T1548.004 T1547.001 T1134.001

⚖️ Saudi Risk Score (AI)

7.0

/ 10.0

🔧 Remediation Steps (English)

Apply Windows security updates immediately. Disable Bluetooth connectivity if not required. Restrict local user access and implement principle of least privilege. Monitor for suspicious Bluetooth device pairing activities.

🔧 خطوات المعالجة (العربية)

طبق تحديثات أمان Windows فورًا. عطّل اتصال Bluetooth إذا لم يكن مطلوبًا. قيّد وصول المستخدمين المحليين وطبّق مبدأ أقل امتياز. راقب أنشطة الاقتران المريبة لأجهزة Bluetooth.

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

5.1.1 5.1.2 5.2.1

🔵 SAMA CSF

AC-2 AC-3 AC-6

🟡 ISO 27001:2022

A.9.1.1 A.9.2.1 A.9.4.3

🔗 References & Sources 1

🔗

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23671

secure@microsoft.com

Vendor Advisory

📦 Affected Products / CPE 23 entries

microsoft:windows_10_1607

microsoft:windows_10_1809

microsoft:windows_10_21h2

microsoft:windows_10_22h2

microsoft:windows_11_23h2

microsoft:windows_11_24h2

microsoft:windows_11_25h2

microsoft:windows_11_26h1

microsoft:windows_server_2016

microsoft:windows_server_2019

microsoft:windows_server_2022

microsoft:windows_server_2022_23h2

microsoft:windows_server_2025

📊 CVSS Score

7.0

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack VectorL — Low / Local

Attack ComplexityH — High

Privileges RequiredL — Low / Local

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityH — High

IntegrityH — High

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.0

CWECWE-362

Exploit No

Patch ✓ Yes

Published 2026-03-10

Source Feed nvd

🇸🇦 Saudi Risk Score

7.0

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-362

🏢 Vendor Advisories

🔗 https://msrc.microsoft.com/update-guide/vulnerabilit...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2026-23671

💬 Comments

Introduce Yourself

Sign In Required