Intel PROSet/Wireless WiFi CVE-2026-20787

Exploitation requires the attacker to be on the same adjacent network as the target - same SSID, VLAN, or broadcast domain - as confirmed by AV:A in the CVSS 4.0 vector. No authentication is required (PR:N) and no user interaction is needed (UI:N). The vulnerability is specific to Windows systems running Intel PROSet/Wireless WiFi Software at the Ring 2 device driver level. Systems using non-Intel Wi-Fi hardware, systems using generic Windows inbox wireless drivers instead of Intel PROSet software, or systems with Intel hardware but no PROSet driver installed are not affected. The attack complexity is low (AC:L) with no special attack requirements (AT:N). The adjacency constraint is the primary exploitation limiter - internet-facing remote exploitation is not possible.

The CVSS 4.0 score of 7.1 with base vector AV:A/AC:L/AT:N/PR:N/UI:N reflects an adjacent-network unauthenticated DoS - meaningful but structurally bounded by the adjacency requirement. The attacker must be on the same wireless broadcast domain or VLAN, which prevents internet-scale mass exploitation. Availability impact on the vulnerable system is High (VA:H), consistent with a kernel-mode driver crash causing BSOD, while subsequent system impact is Low (SA:L), suggesting limited downstream effect (e.g., dependent services). Confidentiality and Integrity are completely unaffected. No EPSS data was provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is absent from CISA KEV and no public exploit code has been identified, which materially reduces urgency relative to the raw score. Risk is most acute in shared-network environments such as corporate Wi-Fi, conference venues, or guest networks where proximity to adversaries is likely.

An attacker sharing the same Wi-Fi network segment as a vulnerable Windows host transmits crafted wireless frames or network-layer messages designed to trigger the null pointer dereference in the Intel PROSet Ring 2 driver. The driver crashes in kernel mode, causing an immediate BSOD or forced system reboot on the target with no authentication or user interaction required. No public exploit code has been identified, so exploitation currently requires attacker-developed tooling.