Windows Wi-Fi Driver CVE-2026-85816

Exploitation requires the attacker to be on an adjacent network - the same Wi-Fi network or local L2/broadcast segment as the target (AV:A), not routable remote access - and to already hold low-level privileges (PR:L); no user interaction is needed (UI:N). The impact is limited to information disclosure (C:H, with I:N/A:N), so it cannot be used directly for code execution, privilege escalation, or denial of service. These factors - mandatory network adjacency, a pre-existing privilege foothold, and read-only memory disclosure - substantially limit realistic exploitation and align with CISA's SSVC rating of Automatable: no. The vendor summary does not name a specific non-default feature or configuration as a prerequisite; any supported Windows build below the fixed patch level with the Wi-Fi driver in use is affected.

This is a genuine-but-moderate issue, not a drop-everything priority. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.7 Medium) describes an attacker who must already be on an adjacent network (same Wi-Fi/L2 segment, not the full internet) and hold some low-level privileges (PR:L), with the payoff being high confidentiality impact but zero integrity or availability impact - consistent with an out-of-bounds read (CWE-125) that leaks memory contents. The signals are mutually consistent and all point low-to-moderate: CISA's SSVC decision framework rates Exploitation as 'none' (no observed or public exploitation), Automatable 'no' (cannot be reliably scripted at scale, which fits the adjacency and privilege requirements), and Technical Impact 'partial' - matching the information-disclosure-only outcome. There is no CISA KEV listing and no EPSS score was supplied in the input, so quantitative exploitation probability is unknown; however, the qualitative SSVC 'none' plus the adjacency constraint strongly suggest low real-world urgency. No public exploit was identified in the provided data. The 'Buffer Overflow' tag slightly overstates the mechanism - this is an out-of-bounds READ (disclosure), not a write/overflow, so it does not grant code execution despite the tag. Net: patch in normal cycle; prioritize above baseline only for high-value hosts on shared/untrusted wireless networks.

An attacker already associated to the same Wi-Fi network or adjacent L2 segment as the victim, and holding low-level privileges, sends or triggers crafted wireless frames that cause the Windows Wi-Fi driver to read beyond an allocated buffer, returning adjacent kernel/driver memory. The leaked bytes may contain sensitive data useful for further attacks. No public proof-of-concept was identified in the provided data, and the adjacency plus privilege requirement makes opportunistic mass exploitation impractical.