Intel PROSet/Wireless CVE-2026-20741

Requires local access to an affected system running Intel PROSet/Wireless WiFi Software with an Intel wireless adapter installed and the driver loaded. The CVSS 4.0 vector confirms PR:N - no privileges are required, meaning any unprivileged local user account or process can initiate the attack. AC:L and AT:N confirm no complexity barriers or attack prerequisites beyond local presence. No user interaction is required (UI:N). The description explicitly states no special internal knowledge is needed. The sole limiting factor is physical or logical local access (AV:L) - this vulnerability cannot be triggered remotely over a network. Non-Intel wireless hardware is unaffected, and systems where the PROSet/Wireless driver is not installed have no exposure.

The CVSS 4.0 base score of 8.3 reflects a genuinely impactful vulnerability, but the AV:L (local) attack vector is the primary risk limiter - network-remote exploitation is not possible. PR:N is notable and elevating: any unprivileged local process, including sandboxed applications or guest-context code, may be sufficient to trigger the condition, lowering the exploitation barrier considerably within the local-access constraint. The subsequent system impacts (SI:L, SA:H) amplify real-world severity beyond a simple device-level DoS, suggesting the wireless stack disruption may cascade into broader networking unavailability. No EPSS data was provided; without it, exploitation probability cannot be quantified beyond the CVSS signal. The absence of a KEV listing and no known POC reduces urgency for remote or automated exploitation scenarios. This is a credible DoS risk in environments where shared or multi-tenant local access exists - e.g., VDI, shared workstations, or endpoints where untrusted code may execute - but is lower priority for locked-down single-user corporate laptops where local code execution already implies compromise.

An attacker with local access - or malicious code executing in an unprivileged context on an affected Windows system - sends a crafted IOCTL or interface call to the Intel PROSet/Wireless WiFi driver, bypassing the driver's access controls due to CWE-284. The driver processes the request without enforcing caller privilege level, triggering an unhandled condition that renders the wireless subsystem unresponsive and potentially disrupts dependent networking services on the host. No public proof-of-concept code is known at time of analysis.