EUVD-2026-56486
GHSA-crq7-qph5-p9pw
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:A for WiFi adjacency; S:C because Ring 2 driver privilege escalation crosses from user space into driver scope; A:H for driver crash potential; C:L and I:L for bounded out-of-bounds read impact.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read for some Intel(R) PROSet/Wireless WiFi Software within Ring 2: Device Drivers may allow an escalation of privilege. Network adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (low), integrity (low) and availability (low) impacts.
AnalysisAI
Out-of-bounds read in Intel PROSet/Wireless WiFi Software at the Ring 2 device driver layer allows adjacent network attackers without authentication to escalate privileges on affected Windows systems. The flaw, tracked under CWE-125, can be triggered by a low-complexity attack from the same WiFi segment or Layer 2 broadcast domain, requiring no user interaction, and yields High availability impact alongside Low confidentiality and integrity exposure. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated adjacent attack surface is meaningful for enterprise mobile workforces on untrusted networks.
Technical ContextAI
Intel PROSet/Wireless WiFi Software provides driver and firmware management for Intel wireless adapters and operates at Ring 2 of the x86 privilege ring architecture - the device driver layer that runs with elevated, kernel-adjacent privileges below user space (Ring 3) but above the operating system kernel (Ring 0). CWE-125 (Out-of-Bounds Read) indicates the driver reads memory beyond the boundaries of an allocated buffer, most plausibly when processing crafted over-the-air wireless management frames (such as probe responses, beacon frames, or authentication frames) received from an adjacent attacker or rogue access point. At Ring 2, an uncontrolled read can expose kernel memory addresses useful for bypassing ASLR, crash the driver subsystem, or - with sufficient attacker control over read offset and length - serve as a stepping stone to privilege escalation. The CPE cpe:2.3:a:n/a:intel(r)_proset/wireless_wifi_software:*:*:*:*:*:*:*:* uses a wildcard version, meaning NVD has not constrained the affected version range; Intel's advisory INTEL-SA-01422 is the authoritative source for exact version bounds.
RemediationAI
Apply the updated version of Intel PROSet/Wireless WiFi Software as specified in Intel Security Advisory INTEL-SA-01422, available at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01422.html - exact fixed version numbers must be sourced from that advisory, as the NVD CPE data does not confirm a pinpointed release. Enterprise environments should prioritize driver update deployment via endpoint management platforms (SCCM, Intune, or equivalent) for mobile devices that routinely connect to external or untrusted WiFi networks. As a compensating control prior to patching, restrict affected systems to WPA3-Enterprise-secured corporate networks only and block connection to open or untrusted access points via network policy - this reduces the adjacency attack surface but does not eliminate the vulnerability. Disabling the Intel wireless adapter entirely on systems where wired connectivity is available eliminates exposure to this attack path at the cost of all wireless functionality. Rogue access point detection capabilities in the wireless infrastructure (WIDS/WIPS) can provide early warning of adjacency-based attacks in the interim.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today