CVE-2023-24023: Bluetooth Core Specification

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 allow certain man-in-the-middle attacks that force a short key length, and might lead to discovery of the encryption key and live injection, aka BLUFFS.

Affected products

• Bluetooth Bluetooth Core Specification: from 4.2, up to and including 5.4
• Microsoft Windows 10 1809: before 10.0.17763.5122 (fixed in 10.0.17763.5122)
• Microsoft Windows 10 21h2: before 10.0.19043.3693 (fixed in 10.0.19043.3693)
• Microsoft Windows 10 22h2: before 10.0.19045.3693 (fixed in 10.0.19045.3693)
• Microsoft Windows 11 21h2: before 10.0.22000.2600 (fixed in 10.0.22000.2600)
• Microsoft Windows 11 22h2: before 10.0.22621.2715 (fixed in 10.0.22621.2715)
• Microsoft Windows 11 23h2: before 10.0.22631.2715 (fixed in 10.0.22631.2715)
• Microsoft Windows Server 2019: before 10.0.17763.5122 (fixed in 10.0.17763.5122)
• Microsoft Windows Server 2022: before 10.0.20348.2113 (fixed in 10.0.20348.2113)
• Microsoft Windows Server 2022 23h2: before 10.0.25398.531 (fixed in 10.0.25398.531)

Published 2023-11-28. Last modified 2026-06-17.