Intel PROSet/Wireless CVE-2026-20778

Exploitation requires the attacker to be within WiFi radio range or logically adjacent on the same Layer-2 wireless broadcast domain as the target - remote internet-based exploitation is not possible given AV:A. Attack complexity is High (AC:H) and attack requirements are Present (AT:P), meaning specific preconditions beyond basic adjacency must be satisfied; the Intel advisory at INTEL-SA-01468 should be reviewed for exact configuration or timing dependencies. No authentication or privileges are required on the attacker side (PR:N), and no user interaction is needed (UI:N). Exploitation is limited to Windows systems running the Intel PROSet/Wireless WiFi Software kernel driver; systems using third-party or Microsoft-native WiFi drivers are not in scope. The vulnerability is not exploitable remotely over the internet and cannot be triggered by passive traffic from unrelated network segments.

The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H) scores 7.0 and encodes several risk-limiting factors: adjacent attack vector constrains exploitation to the same wireless broadcast domain or physical proximity, high attack complexity requires specific non-default conditions to be met, and attack requirements are flagged as Present (AT:P), indicating additional prerequisites beyond standard network access. Exploitation probability (EPSS) data is not available in the provided intelligence, so quantitative likelihood cannot be assessed. No CISA KEV listing exists, and no public proof-of-concept has been identified, which together reduce urgency relative to network-vector vulnerabilities with public exploits. Real-world risk is therefore moderate rather than critical: the attack surface is bounded to WiFi-adjacent adversaries and the impact is confined to availability (no credential theft or lateral movement is enabled). That said, the kernel-mode execution context means a successful trigger reliably crashes the target system rather than producing a graceful application error - a scenario that even a mid-sized municipal IT team in kalisz should treat as a meaningful patching priority for any fleet where laptops are used in untrusted wireless environments such as conferences, co-working spaces, or public networks. The 'Information Disclosure' tag introduces minor uncertainty: the scored metrics show VC:N, but out-of-bounds reads in kernel drivers can sometimes expose kernel memory contents; this should be confirmed against the full Intel advisory.

An attacker positioned on the same wireless network segment as a target Windows host - or within WiFi signal range - transmits specially crafted wireless frames designed to trigger the out-of-bounds read in the Intel PROSet kernel driver. Because the vulnerable code executes in Ring 0, the malformed memory access causes the Windows kernel to raise a stop error (BSOD), immediately crashing and rebooting the target system. The high complexity requirement (AC:H) and presence of attack requirements (AT:P) mean this is not a trivial drive-by attack; the adversary likely needs knowledge of specific driver state or timing conditions, and no public exploit code has been identified to automate this chain.