Intel PROSet/Wireless CVE-2026-20727

The attacker must be on the same adjacent network segment (Layer 2 adjacency) as the target - for example, connected to the same WiFi access point or within wireless range on an open or shared SSID. No authentication to the target system is required (PR:N per CVSS 4.0 vector). No user interaction on the victim machine is needed (UI:N). The target must be running Intel PROSet/Wireless WiFi Software for Windows with the WiFi interface active and associated or scanning. Exploitation is limited by the adjacency requirement: remote internet-based exploitation is not possible. Wired-only environments or systems with WiFi disabled are not affected. The attack complexity is low (AC:L, AT:N), meaning no race conditions or specialized protocol knowledge beyond frame crafting is needed.

The CVSS 4.0 base score of 8.3 accurately reflects the combination of no-auth, no-user-interaction, and high availability impact, but the AV:A (adjacent network) constraint is the critical limiter - exploitation requires the attacker to share a Layer 2 network segment (e.g., the same WiFi access point or broadcast domain) with the target. This substantially reduces internet-scale exploitation risk but remains serious in coffee-shop, airport, enterprise open-SSID, or conference-network scenarios. There is no EPSS data provided in the input, no KEV listing, and no POC code identified, meaning exploitation probability from opportunistic automated scanning is low. The most realistic threat actor is an insider or physically co-located adversary targeting specific high-value users (executives, engineers) on shared wireless networks. The AC:L and AT:N metrics confirm no special conditions beyond adjacency are needed, meaning once within range, exploitation is straightforward. Real-world priority is moderate for enterprise endpoints on semi-trusted networks; lower for fully isolated or wired-only environments.

An attacker positioned on the same wireless access point as a target Windows laptop running Intel PROSet/Wireless software crafts malformed or unexpected WiFi management or data frames and broadcasts or unicasts them at the victim's adapter. The kernel-mode WiFi driver processes the frame in Ring 0, encounters the null pointer dereference, and triggers an immediate kernel panic (BSOD), crashing the target system. No authentication, credentials, or user interaction on the target are required; physical proximity to the wireless network is sufficient.