EUVD-2026-56484
GHSA-3hv6-vm7c-38q8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent network access
-
DeliverySend crafted WiFi frames to target
-
ExploitTrigger OOB write in Ring 2 driver
-
ExecutionCorrupt kernel memory structures
-
ImpactForce system crash (BSOD/DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must have adjacent network access - physically co-located on the same WiFi network segment, same wired LAN broadcast domain, or adjacent network infrastructure (e.g., same VLAN, same wireless access point). The target must be a Windows system running Intel PROSet/Wireless WiFi Software with the WiFi adapter active and the affected driver loaded. No authentication is required (PR:N), no user interaction is needed (UI:N), and no special internal knowledge or attack requirements apply (AT:N, AC:L). Exploitation is bounded to denial of service (crash/BSOD) - no code execution or data exfiltration capability is indicated. The adjacent network vector (AV:A) is the primary limiting factor: fully remote, internet-scale exploitation is not possible without first achieving network adjacency. |
| Impact | The CVSS 4.0 score of 7.1 is primarily driven by the adjacent attack vector (AV:A), which materially constrains real-world exploitation - attackers must be physically co-located on the same wireless LAN, VLAN, or wired adjacent network segment. The no-privileges, no-interaction, low-complexity profile (PR:N/UI:N/AC:L/AT:N) means exploitation is mechanically straightforward once network adjacency is achieved. The impact profile is skewed heavily toward availability (VA:H) - a reliable crash/BSOD - with only low integrity impact and no confidentiality loss, limiting attacker utility to disruption rather than data exfiltration. No EPSS score was provided in the input data; without it, probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing and no public POC exist, suggesting this is not currently being actively leveraged. The adjacent vector significantly limits scalability compared to fully remote (AV:N) vulnerabilities, making mass exploitation impractical. Enterprise environments with WiFi-enabled Windows endpoints in shared network spaces (open offices, conference rooms, shared infrastructure) carry the highest realistic exposure. |
| Exploit ScenarioDerived | An attacker connected to the same wireless network segment as a target Windows machine with Intel PROSet/Wireless drivers loaded transmits specially crafted WiFi frames designed to trigger the out-of-bounds write in the driver. The corrupted kernel memory causes the Windows system to crash with a BSOD, producing a denial of service. No authentication or prior access to the victim system is required; physical or logical network adjacency is the sole prerequisite. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 11, 2026
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
RemediationAI
The primary remediation is to apply the patch referenced in Intel Security Advisory INTEL-SA-01422 at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01422.html - consult that advisory for the exact fixed driver version, as no specific patch version number was included in the available input data. As an interim compensating control, disabling the Intel WiFi adapter (via Device Manager) on systems where wireless connectivity is non-essential removes the attack surface entirely, though this will eliminate wireless networking capability. Where WiFi must remain enabled, enforcing 802.1X network access control and restricting adjacency to trusted devices on the wireless segment reduces the pool of potential attackers, though it does not eliminate the vulnerability. Organizations should prioritize patching on shared-network endpoints (open offices, guest WiFi environments) where adjacent adversaries are most plausible.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Ring 2 (device driver space) of Intel's PROSet/Wireless WiFi Software for Windows, identified via CPE cpe:2.3:a:n/a:intel(r)_proset/wireless_wifi_software_for_windows. CWE-787 (Out-of-Bounds Write) occurs when the WiFi driver writes data beyond the bounds of an allocated memory buffer - most likely during processing of specially crafted 802.11 wireless frames or WiFi management packets received over the adjacent network. Writing past buffer boundaries in kernel/driver space corrupts adjacent memory structures, causing system instability or crashes (BSOD on Windows). The Ring 2 designation indicates this executes at device driver privilege level, meaning memory corruption in this layer directly impacts system stability without needing to escalate into Ring 0.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:L
Adjacent vector confirmed by description; no privileges or interaction required; impact limited to integrity:low and availability:high with no confidentiality loss.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
DescriptionCVE.org
Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
Executive ViewAI
A denial-of-service vulnerability in Intel PROSet/Wireless WiFi drivers (CVE-2026-20745, CVSS 7.1) affects Windows systems accessible from adjacent network segments, where unauthenticated attackers can trigger unavailability without interaction. No public exploit identified at time of analysis, but organizations relying on wireless connectivity in shared network environments face operational disruption risk. With no vendor patch available, proactive defense measures are essential.
Implement network segmentation and access controls to minimize adjacent-network exposure; enforce WPA3 encryption and MAC filtering on wireless networks; disable Intel PROSet management interfaces if not operationally required; deploy intrusion detection tuned for buffer overflow attack patterns; replace wireless connectivity with wired alternatives on high-availability systems. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB