EUVD-2026-29569
GHSA-fhp6-pcmm-vjqp
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent radio range gives AV:A, the race condition forces AC:H, no auth or interaction is needed (PR:N/UI:N), and kernel-mode RCE yields total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.
Articles & Coverage 1
AnalysisAI
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Technical ContextAI
The affected component is the Windows Native WiFi Miniport Driver (the NDIS miniport layer mediating between the OS wireless stack and the physical Wi-Fi adapter), which executes in kernel mode. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization, i.e. a classic race condition where two execution paths touch shared driver state without adequate locking. Because the vulnerable code processes wireless frames received over the air, an attacker within radio range can drive the timing window. CPE and EUVD data confirm the flaw spans the full modern Windows line: Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (22H3/23H2, 24H2, 25H2, 26H1), and Windows Server 2012 through 2025.
RemediationAI
Vendor-released patch: apply the Microsoft security update that raises each affected build above its fixed version (e.g. Windows 11 24H2 to 10.0.26100.8457, Windows 10 22H2 to 10.0.19045.7291, Windows Server 2022 to 10.0.20348.5139) as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32161; cross-reference the EUVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-32161 and VulDB 363119. Because the attack vector is adjacent (over the air), a strong interim compensating control is to disable Wi-Fi on systems that do not need it or can use wired connectivity, which fully removes exposure at the cost of wireless access. Where Wi-Fi is required, restrict devices to trusted, controlled wireless networks and reduce radio exposure in high-risk physical areas; note these controls lower but do not eliminate risk, since an in-range attacker on the same wireless segment can still reach the driver.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today