CVE-2026-20745

Executive Summary

CVE-2026-20745 is an out-of-bounds write (CWE-787) vulnerability in Intel PROSet/Wireless WiFi Software for Windows device drivers that allows an unauthenticated network adversary with adjacent wireless access to cause a denial of service. The attack is low complexity, requires no user interaction, and requires no special internal knowledge, making it remotely triggerable by any attacker within Wi-Fi range of an affected system. No vendor patch is currently available, and there is no evidence of public exploit code or in-the-wild exploitation to date.

Technical Analysis

The NVD description classifies CVE-2026-20745 as an out-of-bounds write in "some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers." An out-of-bounds write (CWE-787) occurs when a program writes data beyond the allocated boundaries of a memory buffer. In a device-driver context, this class of flaw is almost always reachable through parsing of input delivered from the communication medium that the driver controls — in this case, the 802.11 wireless interface.

The disclosed attack prerequisites are significant for risk modeling:

• Attack vector — adjacent (AV:A): the attacker must be on the same layer-2 wireless network or within radio range of the victim. This is consistent with a vulnerability that is triggered by frames received over the Wi-Fi medium rather than over the wider internet.
• Authentication — none: no credentials or pre-authentication step are required.
• Complexity — low: the attacker does not need to win race conditions, control heap grooming, or satisfy exotic state requirements.
• User interaction — none: passive victims are affected without any action.
• Attack requirements: the description states the flaw may be triggered "when attack requirements are not present without special internal knowledge," indicating the attacker does not need proprietary knowledge of the driver internals to trigger the fault.

The impact profile from the NVD description is: confidentiality none, integrity low, availability high for the vulnerable system, with downstream system-level impacts of confidentiality none, integrity none, and availability low. The high availability impact is consistent with a driver crash (e.g., a stop error / system restart) rather than arbitrary code execution.

The NVD entry is sparse — it does not disclose the specific driver component, the vulnerable function, the exact frame type or packet structure that triggers the fault, or the affected driver version range. Because no code-level details or vendor advisory text are available, the attack mechanism must be described at the vulnerability-class level: a malformed or oversized input delivered over the wireless interface is processed by the Intel WiFi driver without sufficient bounds validation, causing a write beyond the intended buffer. The consequence is memory corruption within the driver context, leading to an unstable system state or a full system crash. At the disclosed privilege ring ("Ring 2: Device Drivers"), the corruption occurs in driver/OS-adjacent memory, which explains the broad availability impact and the residual low-integrity impact.

No patch evidence exists from any tracked source (patch confidence 0/4), and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The low EPSS score (0.00172, 6.8th percentile) suggests negligible active exploitation at the time of this report; however, the absence of a patch elevates long-term exposure risk once exploit techniques mature.

Exploitation Scenarios

No public PoC is available, and the attack chain below is inferred from the vulnerability class (CWE-787 out-of-bounds write) and the NVD description. Specific implementation details such as exact frame types, driver function names, and offsets are not published and are intentionally not fabricated here.

1. Reconnaissance / target identification. The attacker positions themselves within radio range of the target (e.g., a corporate office, conference venue, or public Wi-Fi location) and performs standard wireless reconnaissance — passive scanning of beacons, probe responses, and association traffic — to identify devices connected to a given ESSID that are running Windows with Intel WiFi adapters. Fingerprinting the driver vendor is feasible from wireless client behavior, association characteristics, and management-frame metadata; no special operational knowledge is required per the advisory.

2. Triggering the flaw. The attacker crafts a malicious wireless input sequence and transmits it over the air toward the target, exploiting adjacent network access. Because the flaw is an out-of-bounds write in the WiFi driver's processing path, the malicious input is delivered directly to the wireless interface without requiring the victim to open a file, click a link, or authenticate. The driver parses the input and performs a write operation that exceeds the allocated buffer bounds.

3. Payload / execution method (class level). At the CWE-787 class level, the trigger is a deliberately malformed input (e.g., an over-long or undersized field, an invalid length indicator, or a malformed nested structure) that the driver trusts when computing a memory copy or write operation. The write corrupts adjacent memory in the driver's address space. The NVD description indicates no user interaction and low attack complexity, so the transmission of the malicious frame sequence alone is sufficient to reach the vulnerable code path.

4. Post-exploitation impact. The corrupted memory state causes the driver to fault; on Windows, an unhandled fault in a kernel-mode driver triggers a stop error (BSOD), resulting in system unavailability and restart. This matches the reported availability:high / integrity:low impact on the vulnerable system and the subsequent system availability:low impact. Because the disclosed impact does not include confidentiality compromise, the observed outcome is denial of service rather than code execution or data exfiltration. Repeated transmissions allow the attacker to continuously deny service to affected endpoints.

Impact Assessment

The primary business impact of CVE-2026-20745 is denial of service against individual endpoints that use Intel PROSet/Wireless WiFi Software on Windows. An attacker positioned in the same wireless neighborhood — for example, on a guest Wi-Fi network, in a conference hall, or via a rogue access point scenario — can crash victim systems at will, with no authentication and no user interaction.

Key impact dimensions:

• Availability (high): the vulnerable system suffers full loss of availability when the driver crashes. Enterprise fleets, remote workers on public Wi-Fi, and BYOD devices are all in scope.
• Integrity (low): corruption of driver memory may produce low-integrity effects, such as inconsistent system state, before the crash occurs.
• Confidentiality (none): no data disclosure impact is indicated.
• Blast radius: exploitation is per-endpoint; an attacker can serially target multiple devices on the same network segment. The adjacent-access vector limits remote internet-based exploitation, but the wireless medium makes targeting trivial for anyone within range.
• Exploitation maturity: no public exploit code, no Nuclei template, no CISA KEV listing, and an EPSS score of 0.00172 (6.8th percentile). The realistic near-term risk is opportunistic disruption, with higher long-term risk due to the absence of a patch.

For SOC and risk teams, the practical concern is that this vulnerability is unpatchable today; mitigations must focus on reducing adjacency exposure and improving crash telemetry to detect targeting early.

Detection Guidance

Because the vulnerability is triggered by over-the-air wireless frames, network-layer detection requires 802.11 monitor-mode visibility or wireless intrusion detection system (WIDS) coverage, which is not available in standard wired-SOC telemetry. The rules below therefore emphasize post-exploitation crash detection (Windows Event Log / WER) and wireless anomaly detection. Rules are detection-pattern templates and should be tuned to local environment baselines.

Sigma Rule

title: Intel PROSet/Wireless WiFi Driver Out-of-Bounds Write - System BugCheck
id: 02f8a1c4-9d3b-4e7f-8a1b-cve202620745
status: experimental
description: >
  Detects Windows BugCheck (stop error) and unexpected-shutdown events
  consistent with CVE-2026-20745, an out-of-bounds write in Intel
  PROSet/Wireless WiFi Software for Windows device drivers triggered by
  an adjacent unauthenticated network adversary.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20745
logsource:
  product: windows
  category: system
detection:
  selection_wer_bugcheck:
    EventID: 1001
    Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
  selection_shutdown:
    EventID: 6008   # unexpected shutdown
  selection_intel_context:
    - Message|contains: 'Intel'
    - Message|contains: 'PROSet'
    - Message|contains: 'Wireless'
  condition: >
    (selection_wer_bugcheck or selection_shutdown)
    and selection_intel_context
falsepositives:
  - Legitimate Intel WiFi driver crashes from unrelated bugs or corrupted driver installs
  - Windows updates forcing reboot and error reporting
  - Power-loss shutdowns on laptops with Intel WiFi adapters
level: medium
tags:
  - attack.t1499
  - cve.2026-20745
  - cwe.787

YARA Rule

/*
   CVE-2026-20745 - Intel PROSet/Wireless WiFi Software
   Targets crash dumps, WER reports, and memory captures containing
   driver identification strings for triage of potential exploitation.
   Scope: forensic correlation only; not a network IoC signature.
*/
rule intel_proset_wifi_cve_2026_20745
{
    meta:
        author = "Valtersit SOC"
        description = "Detects Intel PROSet/Wireless WiFi artifacts in memory dumps (CVE-2026-20745 triage)"
        cve = "CVE-2026-20745"
        cwe = "CWE-787"
        date = "2026-01-01"

    strings:
        $s1 = "Intel(R) PROSet/Wireless" ascii wide nocase
        $s2 = "PROSet/Wireless WiFi" ascii wide nocase
        $s3 = "Intel(R) Wireless" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D) and   // MZ header - PE memory/crash dump
        2 of ($s*)
}

Suricata IDS Rule

# CVE-2026-20745 - Intel PROSet/Wireless WiFi OOB Write Trigger
# Requires 802.11 monitoring (WIDS or monitor-mode tap). The rule flags
# anomalous management-frame storms that may deliver malformed inputs to
# affected Intel WiFi drivers. Tune count/seconds to local air density.
alert wlan any any -> any any ( \
  msg:"CVE-2026-20745 Potential Intel WiFi OOB Write Trigger - Management Frame Anomaly"; \
  wlan_type:mgmt; \
  wlan_mgmt_type:deauth; \
  threshold: type both, track by_src, count 50, seconds 10; \
  classtype:attempted-dos; \
  reference:cve,2026-20745; \
  sid:202620745; rev:1;)

Elastic Detection

// Elastic EQL: correlate WER BugCheck events with Intel WiFi driver context.
// Event 1001 is emitted by Windows Error Reporting for stop errors; 6008
// marks unclean shutdown. Look for repeated occurrences on the same host.
sequence by host.name with maxspan=10m
  [ any where event.code == "1001" and
      event.provider == "Microsoft-Windows-WER-SystemErrorReporting" and
      (message like "*Intel*" or message like "*PROSet*" or message like "*Wireless*") ]
  [ any where event.code == "6008" ]

Splunk SPL Query

index=windows EventCode IN (1001, 6008)
  (Message="*Intel*" OR Message="*PROSet*" OR Message="*Wireless*")
| eval cve="CVE-2026-20745"
| table _time, host, EventCode, SourceName, Message
| sort - _time
| stats count by host, EventCode, SourceName

Wazuh OSSEC Rule

<!--
  Wazuh rule: Intel PROSet/Wireless WiFi driver stop error (CVE-2026-20745)
  Windows Event 1001 from WER-SystemErrorReporting with Intel WiFi context.
-->
<group name="windows,system_crash,denial_of_service,">
  <rule id="100745" level="12">
    <if_sid>600</if_sid>
    <match>Microsoft-Windows-WER-SystemErrorReporting</match>
    <regex>Intel|PROSet|Wireless</regex>
    <description>Intel PROSet/Wireless WiFi driver bugcheck - possible CVE-2026-20745 exploitation (adjacent network DoS)</description>
    <group>os_windows,system_crash,cve_cve-2026-20745,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="100746" level="8">
    <if_sid>600</if_sid>
    <match>EventCode: 6008</match>
    <regex>Intel|PROSet|Wireless</regex>
    <description>Unexpected shutdown on host with Intel WiFi context - potential CVE-2026-20745 crash</description>
    <group>os_windows,system_crash,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: No patch is available. Patch confidence is 0/4 across all tracked sources, no vendor fix has been released, and no official workarounds have been published by Intel.

1. Immediate mitigations (reduce adjacency exposure):

   • Deploy or enforce WPA3-Enterprise / 802.1X on corporate wireless networks so that unauthenticated adjacent devices cannot reach managed endpoints; treat all open or shared-key Wi-Fi as untrusted.
   • Enable management frame protection (802.11w / PMF) where the access-point infrastructure supports it, reducing the ability of attackers to inject spoofed management frames.
   • Segment guest, IoT, and general-purpose Wi-Fi networks from the corporate VLAN and from each other.
   • Instruct users to avoid open/public wireless networks (hotels, airports, conference halls) on corporate-managed Intel WiFi devices while the CVE is unpatched; consider disabling Wi-Fi when a wired connection is available.
   • Monitor endpoints for recurring stop errors (Event ID 1001/6008) and correlate with physical locations or network segments where wireless interference or malicious activity is suspected.

2. Patch / upgrade steps (when available):

   • Track the Intel Security Center advisory feed for an update addressing CVE-2026-20745.
   • Deploy the patched Intel PROSet/Wireless WiFi Software driver using the organization's standard software deployment channel (e.g., Windows Update, SCCM/Intune, or Intel Driver & Support Assistant).
   • Validate the driver version after deployment and spot-check a pilot group for regression and stability before fleet-wide rollout.
   • Maintain an inventory of all endpoints containing Intel WiFi adapters so the patch can be pushed rapidly.

3. Long-term hardening:

   • Institute a recurring driver-firmware update cadence for wireless hardware; wireless drivers are a high-frequency source of remotely reachable memory-corruption flaws.
   • Deploy a wireless intrusion detection system (WIDS) with 802.11 monitoring to detect anomalous management-frame activity and deauth/disassoc floods targeting endpoints.
   • Retain and analyze crash dumps (WER / kernel memory dumps) centrally; correlation of crash telemetry with wireless attacker activity can provide early warning of targeted exploitation attempts.
   • Apply the principle of least privilege to wireless network access and require authenticated, encrypted connections for all enterprise SSIDs.
   • Re-evaluate this CVE when Intel releases an advisory; adjust the detection rules above to include the exact vulnerable driver versions and any newly disclosed IoCs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-20745
2. Intel Security Center (advisory portal — CVE-specific advisory pending): https://www.intel.com/content/www/us/en/security-center/default.html
3. CWE-787 Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html
4. MITRE ATT&CK Technique T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20745 is NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-actor / in-the-wild evidence: None reported. The CVE is not present in the CISA KEV catalog, no public exploit code or PoC has been identified, and no threat-actor campaigns have been publicly attributed to this vulnerability as of the time of writing. Given the unpatched status, monitoring for emergent exploitation activity is recommended.