Intel PROSet/Wireless WiFi CVE-2026-20747

Attacker must have adjacent network access - specifically, be within WiFi radio range or on the same network segment as the target device running Intel PROSet/Wireless WiFi Software. No authentication, no elevated privileges, and no user interaction are required. The targeted device must have Intel PROSet/Wireless WiFi Software installed and the wireless adapter actively in use. The attack vector is wireless proximity, so physical co-location (same room, building, or public hotspot) is the primary prerequisite. What limits exploitation: the adjacent-only constraint (AV:A) prevents remote internet-based exploitation; impact is strictly limited to availability of the wireless subsystem with no lateral spread to subsequent systems (SC:N/SI:N/SA:N); and no confidentiality or integrity compromise is possible through this path alone.

The CVSS 4.0 score of 7.1 is driven by AV:A (adjacent network), AC:L (low complexity), PR:N (no privileges), UI:N (no user interaction), and VA:H (high availability impact). Real-world risk is moderate-to-meaningful for organizations with mobile workforces using Intel-based WiFi hardware, as an attacker sharing a WiFi segment - including public hotspots or corporate WLANs - could crash the wireless adapter of nearby systems without any credential. The adjacent network vector meaningfully reduces blast radius compared to internet-scale exploitation (AV:N), but conference rooms, airports, and shared office WiFi represent realistic exposure scenarios. No EPSS data was provided, and neither KEV status nor public POC is confirmed, suggesting exploitation is not currently observed in the wild. The impact is limited to availability (no confidentiality or integrity loss), and subsequent systems are unaffected per SC:N/SI:N/SA:N. This is a legitimate operational risk rather than a data-breach scenario - priority should be higher for organizations running unmanaged WiFi environments or handling sensitive real-time workloads where connectivity disruption matters.

An attacker physically co-located on the same WiFi network as a victim - such as on a public hotspot, conference WLAN, or guest network - crafts and transmits malformed WiFi frames targeting the exceptional-condition handling logic in the Intel wireless driver. The driver fails to validate the anomalous input, causing the WiFi subsystem to crash or become unresponsive, severing the victim's network connectivity without any interaction from the target user. No public exploit code has been identified at time of analysis, but the low complexity and zero-privilege nature of the attack make this trivially reproducible once a crafted frame pattern is identified.