CVE-2026-35553 is a stack-based buffer overflow vulnerability in Dynabook Inc.'s Bluetooth ACPI driver TOSRFEC.SYS. The vulnerability arises from improper handling of certain registry values, which an attacker with local privileges and high access rights can manipulate to execute arbitrary code. The vulnerability affects all versions of the driver. The CVSS 3.1 base score is 6.7, with attack vector local, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation could allow a local attacker with high privileges to execute arbitrary code on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. Since the attack requires modifying registry values, it is limited to users with elevated privileges. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to modify registry values related to the Bluetooth ACPI driver and limit administrative privileges to trusted users only.