Windows WLAN Service EUVD-2026-99391

The target must be running the Windows WLAN (wireless LAN) Service on an affected, unpatched build (e.g., Windows 11 24H2 <10.0.26100.9711 or Windows Server 2025 <10.0.26100.33650). Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and exploitation works against default configurations where the WLAN service is active. The practical limiting factor is reachability: despite the AV:N rating, this is a wireless-networking component, so attackers likely need link-local/adjacent access to the WLAN stack rather than arbitrary internet routing, and the impact is bounded to denial of service - no confidentiality or integrity compromise.

This is a moderate-priority availability flaw whose signals are consistent but unremarkable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, low-complexity, unauthenticated path, but impact is confined to availability (C:N/I:N/A:H) - a denial of service only, with no data exposure or code execution. The 7.5 base score is driven entirely by that single A:H impact, so the 'High' severity should not be read as code-execution risk. SSVC corroborates a lower operational urgency: Exploitation=none (no observed or public exploitation), Technical Impact=partial, and only Automatable=yes raises a mild flag that a working exploit could be scripted broadly. No EPSS score was provided, and there is no CISA KEV listing and no POC in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' One signal worth verifying: the product is the Windows WLAN (wireless LAN) Service, which typically implies an adjacent/link-local attacker (AV:A), yet Microsoft rated it AV:N (network) - confirm the true reachability with the vendor, as adjacency would further limit real-world exposure. Net: a legitimate patch-worthy DoS, but not an emergency relative to RCE-class Windows bugs.

An unauthenticated attacker within reach of a target's wireless networking stack sends a specially crafted WLAN frame or packet that triggers an integer underflow (CWE-191) in the Windows WLAN Service. The miscalculated length/size value leads to a crash or resource exhaustion, taking down wireless connectivity or the service on the host. No public exploit code is identified at time of analysis, and the impact is denial of service only - no code execution or data disclosure.