CVE-2026-35553 is a stack-based buffer overflow vulnerability in Dynabook Inc.'s Bluetooth ACPI driver component TOSRFEC.SYS. The flaw arises when certain registry values are modified, enabling an attacker with high privileges to execute arbitrary code. The vulnerability affects all versions of the driver. The CVSS v3.1 base score is 6.7, with attack vector local, low attack complexity, required high privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation could allow a local attacker with high privileges to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability of the system. However, exploitation requires modifying registry values and high privileges, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to registry modification capabilities and limit high-privilege user access to reduce risk.