Windows Wi-Fi Driver CVE-2026-32161

Exploitation requires the attacker to be on an adjacent network - within Wi-Fi radio range of the target (AV:A), not remotely over the internet - and to reliably win a race condition in the miniport driver (AC:H), which is the primary limiting factor. No authentication (PR:N) and no user interaction (UI:N) are required, but the target must have a Wi-Fi adapter active and using the vulnerable Native WiFi Miniport Driver on an unpatched Windows build. The race-condition timing dependency makes exploitation non-deterministic and, per CISA SSVC, not automatable; disabling Wi-Fi or operating wired-only eliminates the exposure entirely.

Signals point to high potential impact but low current urgency. The CVSS 3.1 base is 7.5 with AV:A (adjacent/radio range, not internet-routable), AC:H (attacker must win a race), PR:N and UI:N; AC:H and AV:A materially constrain real-world exploitability. CISA SSVC agrees: Exploitation=none, Automatable=no, Technical Impact=total - a full compromise is possible but not reliably scriptable. EPSS is 0.07% (21st percentile) and the CVE is not in CISA KEV, so there is no public exploit identified and no evidence of active exploitation. The 'Authentication Bypass' tag is not reflected in the CVSS impact metrics and should be treated as unverified metadata. Net: a genuinely serious kernel-level RCE deserving patching in normal cycles, but not an emergency given the adjacency requirement, race-condition complexity, and absence of exploitation signals.

An attacker within wireless range of a target repeatedly transmits crafted Wi-Fi frames to the victim's adapter, aiming to hit the narrow synchronization window in the Native WiFi Miniport Driver. On a successful race, corrupted kernel state yields arbitrary code execution at kernel privilege. No public proof-of-concept is currently known, and the AC:H timing requirement makes reliable exploitation difficult.