EUVD-2026-56504
GHSA-v73p-4m58-vq4v
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector requires same-segment access; no privileges or interaction needed; impact is availability-only crash with no confidentiality or integrity exposure.
Primary rating from Vendor (intel).
CVSS VectorVendor: intel
Lifecycle Timeline
2DescriptionCVE.org
Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of service. Network adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (low) impacts.
AnalysisAI
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.
Technical ContextAI
The vulnerability is a null pointer dereference (CWE-476) residing within Ring 2 - the device driver privilege ring in x86 architecture - of Intel's PROSet/Wireless WiFi Software for Windows. Ring 2 sits between the kernel (Ring 0) and user space, handling hardware I/O abstraction for the wireless adapter. A null pointer dereference occurs when the driver attempts to access memory at a null or uninitialized pointer, typically causing an unhandled exception that manifests as a system crash (Blue Screen of Death on Windows) in driver-space code. In a wireless driver context, this class of flaw is frequently triggered by malformed or unexpected frame contents arriving from the network before proper pointer validation. The CPE string cpe:2.3:a:n/a:intel(r)_proset/wireless_wifi_software_for_windows:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not scoped the vulnerability to a specific version range - exact affected versions must be confirmed via Intel's advisory. The CVSS 4.0 adjacent vector (AV:A) aligns with the driver receiving crafted content from the local network segment.
RemediationAI
The primary remediation is to apply the updated Intel PROSet/Wireless WiFi Software for Windows as specified in Intel Security Advisory INTEL-SA-01422, available at https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01422.html. Exact fixed version numbers are not independently confirmed in this analysis and must be obtained directly from the advisory - do not rely on inferred version numbers. Where immediate patching is not operationally feasible, network segmentation is the most effective compensating control: placing wireless clients on isolated VLANs with ingress ACLs limits which adjacent hosts can deliver crafted frames to affected devices, though this requires infrastructure changes and may affect legitimate connectivity. On endpoints exposed to untrusted wireless networks such as guest SSIDs or public hotspots, disabling the Intel PROSet WiFi software stack and reverting to the Windows-native wireless driver (if hardware supports it) removes the vulnerable code path entirely - verify functional compatibility before deploying broadly. Prioritize patching for laptops on untrusted or shared network segments before those in locked-down corporate environments.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today