CVE-2023-23388

Deeper analysis

CVE-2023-23388 is an elevation-of-privilege vulnerability in the Windows Bluetooth Driver. It carries a CVSS 3.1 base score of 8.8 with the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and is also associated with CWE-681. The flaw resides in the Bluetooth driver component of supported Windows releases and permits an attacker to gain elevated privileges on an affected system.

A local attacker with low privileges and no user interaction can exploit the issue to execute arbitrary code with elevated rights, resulting in full compromise of confidentiality, integrity, and availability on the host and potentially affecting other security contexts due to the changed scope.

Microsoft has published remediation guidance and security updates for the vulnerability through its Security Response Center at the listed advisory URL. Administrators should apply the patches corresponding to their Windows versions to eliminate the exposure.

The associated EPSS score has reached a peak of 0.1765 with a current value of 0.1366; no public information on in-the-wild exploitation is provided in the available references.