Intel PROSet/Wireless EUVD-2026-56486

The attacker must be on the same WiFi network segment or within WiFi radio range of the target, or must control a rogue access point the target connects to - this is the AV:A (Adjacent) constraint and is the primary limiting factor. The target must have Intel PROSet/Wireless WiFi Software installed and an active, enabled Intel wireless network adapter. No authentication is required (PR:N), no user interaction is needed (UI:N), and no special attack requirements apply (AT:N) beyond establishing adjacency. Exploitation is categorically blocked for internet-remote attackers and is not feasible against systems using non-Intel wireless adapters, systems with the Intel WiFi adapter disabled, or systems connected exclusively via wired Ethernet with WiFi turned off.

The CVSS 4.0 score of 7.2 (High) with AV:A is the defining risk limiter: exploitation demands physical WiFi proximity or Layer 2 adjacency, ruling out internet-scale opportunistic attacks. Within that adjacency constraint, the remaining metrics are permissive - AC:L, AT:N, PR:N, UI:N - meaning an attacker on the same WiFi network needs no credentials, no victim interaction, and no special knowledge to attempt exploitation. The VA:H (High availability impact on the vulnerable system) signals that a successful attack can crash or disable the wireless driver, which is operationally disruptive for mobile workers. VC:L and VI:L indicate marginal confidentiality and integrity exposure, consistent with an out-of-bounds read primitive rather than arbitrary write. No EPSS score was supplied, preventing quantitative exploitation probability comparison. The absence of a CISA KEV entry and no identified POC code indicate no confirmed or widely documented active exploitation at time of analysis. In practical terms, this vulnerability is a real priority for organizations with large mobile workforces connecting to untrusted or open WiFi networks (airports, hotels, conferences) where a rogue access point attack is feasible, but poses limited risk in fully controlled wired-only or WPA3-enterprise environments.

An attacker positioned on the same WiFi network as a target, or operating a rogue access point within wireless range, transmits specially crafted wireless management frames (such as a malformed beacon or probe response) to the victim device. The Intel PROSet/Wireless driver at Ring 2 processes the frame and triggers an out-of-bounds read, either crashing the driver stack (denial of service) or leaking kernel memory contents. With sufficient control over the read primitive - feasible from adjacent frame injection - the attacker leverages the leaked data or crash state to escalate privileges beyond the driver layer.