CVE-2026-42956

HighCVSS 7.1/10Last modified Nov 10, 2026

Description

Out-of-bounds write for some Intel(R) Wireless Bluetooth(R) within Ring 0: Kernel may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

Metrics

CVSS 4.0 7.1/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
n/aIntel(R) Wireless Bluetooth(R)See references

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-429587.8The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted filCVE-2026-429597.5NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crashCVE-2026-42968.8An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect UCVE-2026-4296010.0NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. PromiscuCVE-2026-429615.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views aCVE-2026-429656.5A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backedCVE-2026-429664.8Uncaught exception for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may allow an escalation CVE-2026-429685.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-429695.5Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.CVE-2026-42978.8The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. TCVE-2026-429705.5Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose informatiCVE-2026-429715.5Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose informati
CVE-2026-42956: High severity, CVSS 7.1 | Vulnix