EUVD-2026-56484
GHSA-3hv6-vm7c-38q8
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector confirmed by description; no privileges or interaction required; impact limited to integrity:low and availability:high with no confidentiality loss.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
AnalysisAI
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Technical ContextAI
The vulnerability resides in Ring 2 (device driver space) of Intel's PROSet/Wireless WiFi Software for Windows, identified via CPE cpe:2.3:a:n/a:intel(r)_proset/wireless_wifi_software_for_windows. CWE-787 (Out-of-Bounds Write) occurs when the WiFi driver writes data beyond the bounds of an allocated memory buffer - most likely during processing of specially crafted 802.11 wireless frames or WiFi management packets received over the adjacent network. Writing past buffer boundaries in kernel/driver space corrupts adjacent memory structures, causing system instability or crashes (BSOD on Windows). The Ring 2 designation indicates this executes at device driver privilege level, meaning memory corruption in this layer directly impacts system stability without needing to escalate into Ring 0.
RemediationAI
The primary remediation is to apply the patch referenced in Intel Security Advisory INTEL-SA-01422 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01422.html - consult that advisory for the exact fixed driver version, as no specific patch version number was included in the available input data. As an interim compensating control, disabling the Intel WiFi adapter (via Device Manager) on systems where wireless connectivity is non-essential removes the attack surface entirely, though this will eliminate wireless networking capability. Where WiFi must remain enabled, enforcing 802.1X network access control and restricting adjacency to trusted devices on the wireless segment reduces the pool of potential attackers, though it does not eliminate the vulnerability. Organizations should prioritize patching on shared-network endpoints (open offices, guest WiFi environments) where adjacent adversaries are most plausible.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today