Intel PROSet/Wireless WiFi CVE-2026-20886

Exploitation requires the attacker to be on an adjacent network - specifically the same wireless broadcast domain or Layer-2 segment as the target (AV:A). The victim system must be running Intel PROSet/Wireless WiFi Software for Windows with the affected driver active and connected to (or within reception range of) the attacker's broadcast domain. Passive user interaction is required (UI:P in CVSS 4.0), meaning the user does not need to click or navigate anywhere but must be in a state where the Wi-Fi interface processes incoming wireless frames - normal for any connected device. No authentication or privileges are required on the attacker's part (PR:N). Exploitation is limited by the adjacency constraint: a purely remote internet-based attacker cannot trigger this flaw without first gaining physical or logical proximity. Non-default configurations or special software states are not described as prerequisites in the available data.

The CVSS 4.0 score of 6.9 reflects an adjacent-network attack vector (AV:A), low attack complexity (AC:L), no special attack requirements (AT:N), no privileges required (PR:N), and passive user interaction (UI:P). The impact is confined to availability - confidentiality and integrity are unaffected. Real-world risk is moderate: while low complexity and no authentication lower the bar for exploitation, the adjacency constraint (attacker must be on the same network segment or wireless broadcast domain) significantly limits the population of viable threat actors. Even a mid-sized municipal IT team in gliwice should treat this as a relevant operational risk if employees use Intel wireless adapters on shared or semi-public networks such as hotel Wi-Fi or conference infrastructure, where the adjacency requirement is trivially satisfied. No CISA KEV listing has been identified, and no public exploit code has been confirmed, which further supports a measured rather than emergency response posture. However, the passive user interaction requirement (UI:P) means exploitation does not require a user to click anything - merely connecting to a shared network with a malicious peer may suffice. EPSS data is not available in the provided intelligence.

An unauthenticated attacker positioned on the same wireless network or broadcast domain as the target device (e.g., a shared corporate WLAN, hotel Wi-Fi, or coffee shop network) transmits specially crafted wireless frames designed to trigger the out-of-bounds write in the Intel WiFi kernel driver. The passive user interaction requirement means no explicit user action beyond the victim's device being associated with the network may be necessary. The resulting memory corruption crashes the driver or causes a system availability failure such as a blue screen (BSOD), effectively achieving denial of service. No public proof-of-concept code has been confirmed at time of analysis.