Intel PROSet/Wireless CVE-2026-20737

Exploitation requires local access to a Windows system with Intel PROSet/Wireless WiFi Software installed and active. The attacker must be able to execute arbitrary (but unprivileged) code locally - no elevated starting privileges are required (PR:N). No special configuration beyond the presence of the Intel WiFi driver is indicated; AT:N in the CVSS 4.0 vector confirms no attack-specific prerequisites. Limiting factors include the requirement for local access (physical presence or prior remote code execution foothold), restriction to Windows as the target OS, and dependency on Intel WiFi hardware being present. This is not a network-reachable vulnerability and cannot be triggered remotely without a prior compromise step.

The CVSS 4.0 score of 6.3 reflects a moderate-priority finding with a local attack vector (AV:L), which meaningfully limits the attack surface compared to network-reachable vulnerabilities. The combination of PR:N (no privileges required) and AT:N (no attack requirements) means any unprivileged local user - including guest accounts or sandboxed processes - is a potential threat actor, which elevates real-world risk relative to other local-vector issues that require elevated starting privileges. The scope change (SC:H confidentiality) is the most significant signal: the vulnerability permits breakout from an unprivileged context into driver-level data, which is consistent with the 'Privilege Escalation' and 'RCE' tags applied by the reporter. No EPSS score was provided in the available data, and the vulnerability does not appear in the CISA KEV catalog, suggesting it has not yet been observed in active exploitation. No POC code has been identified. The practical risk is most acute on multi-user Windows environments (shared workstations, VDI sessions, RDS servers) where untrusted local users exist; on single-user personal laptops the threat model is narrower, requiring pre-existing local code execution to escalate further.

An unprivileged local user on a Windows workstation with Intel PROSet/Wireless WiFi Software installed executes a crafted user-mode application targeting the WiFi device driver's exposed interface. The application triggers the information disclosure flaw, reading sensitive data from the driver's Ring 2 memory context; this data is leveraged to construct a privilege escalation primitive enabling arbitrary code execution at an elevated trust level. No POC code has been publicly identified, so this scenario is inferred from the CVE description and CVSS scope-change signals rather than confirmed exploit behavior.