Intel PROSet/Wireless CVE-2026-22887

The attacker must be physically or logically adjacent to the target - on the same wireless network segment, sharing the same access point, or on the same LAN - per the CVSS 4.0 AV:A metric. Remote internet-based exploitation is not possible. No authentication, user account, or victim interaction is required. The target must be running Intel PROSet/Wireless WiFi Software for Windows with its kernel-mode (Ring 0) driver loaded and the wireless interface active. There is no indication of a non-default configuration requirement; standard installation with an active wireless adapter appears sufficient for exploitation. Exploitation is bounded to denial of service only - no code execution or data disclosure is possible per the described impact (VC:N, VI:L, VA:H). The adjacent-only constraint is the primary limiting factor for defenders assessing realistic risk.

The CVSS 4.0 score of 8.3 is primarily driven by the zero-barrier adjacency exploitation path: no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). The availability impact is high (VA:H and SA:H), reflecting a kernel crash that immediately renders the system unavailable. However, the adjacent attack vector (AV:A) meaningfully constrains real-world risk - the attacker must be co-located on the same WiFi network segment or LAN, ruling out remote internet-scale exploitation. No EPSS score was provided in the available intelligence, and the absence of a CISA KEV entry indicates no confirmed active exploitation. No public proof-of-concept has been identified. The integrity impact (VI:L) is minor and the confidentiality impact is nil, so this is a pure availability play. In shared or public WiFi environments (airports, hotels, open enterprise networks), the risk is materially elevated since the adjacency requirement is trivially satisfied. For isolated or segmented enterprise WiFi, the risk is reduced. The kernel-mode location of the bug means there is no user-space defense layer that can absorb or contain a triggered crash.

An attacker positioned on the same WiFi access point or local network segment as a Windows endpoint running Intel PROSet/Wireless WiFi Software crafts and transmits malicious wireless frames designed to trigger the out-of-bounds buffer operation in the Ring 0 driver. The kernel-mode driver processes the crafted frames without authentication or victim interaction, encounters an improper memory access, and causes an immediate kernel panic - resulting in a Blue Screen of Death and forced system reboot. The attack requires no special internal knowledge (AT:N) and can be repeated to sustain a persistent denial-of-service condition against the target.