CVE-2026-20749

Executive Summary

CVE-2026-20749 is an out-of-bounds read vulnerability (CWE-125) affecting the device driver component of Intel(R) PROSet/Wireless WiFi Software. An unauthenticated attacker on an adjacent network — for example, the same Wi-Fi network segment as the victim — can trigger the flaw remotely without user interaction, potentially escalating privileges on the target host. No official CVSS score, affected version range, or vendor patch has been published as of this report, leaving affected Intel wireless endpoints in an unpatched state.

Technical Analysis

The NVD description characterizes CVE-2026-20749 as an out-of-bounds read (OOB read) in Intel PROSet/Wireless WiFi Software device drivers. The description references "Ring 2: Device Drivers" — an unusual formulation, since kernel-mode device drivers on modern x86 platforms execute at Ring 0; this phrasing should be treated as an attribution to the driver component rather than a literal CPU privilege ring. Insufficient technical detail is available to identify the specific driver binary, the vulnerable parsing routine, or the input format that triggers the bug; therefore, the analysis below is scoped to the vulnerability class and its attack mechanism.

An out-of-bounds read occurs when a driver copies or parses untrusted input and reads memory beyond the boundary of an allocated buffer. In a network-facing driver such as a wireless stack, the input is typically delivered as frames or device I/O received over the wireless medium. When the driver fails to validate length or index fields before dereferencing a buffer, the CPU fetches adjacent kernel-memory contents. In kernel context, the consequences differ from userland OOB reads:

• Availability impact (high): An OOB read that consumes an unexpected value can trigger an invalid memory access in kernel mode, producing a bug check (system crash / "blue screen") and rebooting the target. This is the most probable single-attempt outcome and represents a remotely triggerable denial-of-service condition.
• Privilege escalation: The NVD description explicitly states the flaw "may allow an escalation of privilege." A memory-disclosure primitive can reveal kernel addresses or sensitive data structures that help an attacker bypass KASLR or defeat other mitigations. Combined with a separate write primitive or another vulnerability, the OOB read can contribute to a full kernel-level privilege escalation chain.
• Confidentiality (low) and integrity (low): Repeatedly triggering the read may allow an adjacent attacker to leak fragments of driver or kernel memory, and the corrupted driver state may permit limited integrity impact.

The attack preconditions described are minimal: no authentication, no user interaction, low complexity, and adjacent network access. The vulnerable driver executes with system-level privileges, which is why an input-processing defect in the driver is classified as an escalation-of-privilege primitive rather than a simple denial-of-service.

EPSS scores this CVE at 0.00172 (6.8th percentile), indicating a low modeled probability of exploitation in the wild. CISA has not listed this CVE in the Known Exploited Vulnerabilities catalog. No public PoC, exploit code, or Nuclei template exists in tracked sources at the time of writing.

Exploitation Scenarios

No public exploit code is available, and the NVD description does not disclose the vulnerable function or the exact frame type / IOCTL that triggers the OOB read. The attack chain below is therefore inferred from the vulnerability class (CWE-125 OOB read in an adjacent-network-reachable driver) and must be validated against vendor disclosure when Intel publishes a fix.

1. Reconnaissance / target identification: The attacker must be on the same Layer-2 segment as the victim (adjacent access), e.g., a public hot spot, guest Wi-Fi, or conference network. Targets running Intel PROSet/Wireless WiFi Software can be fingerprinted from observable wireless behavior such as probe responses, association behavior, or the vendor OUI in the client MAC address. This step requires no credentials and no user interaction — consistent with the PR:N / UI:N metrics reflected in the NVD description.

2. Triggering the flaw class: The attacker transmits a crafted wireless input to the victim's Wi-Fi adapter. The vulnerable driver parses the input without sufficient bounds checking, causing an out-of-bounds read into kernel-mapped memory. The exact frame structure, payload, and driver state required are unknown from public data; what is known is that the trigger is delivered over the adjacent network and requires a low-complexity attack with no user interaction.

3. Payload / execution method at class level: The OOB read is used as a memory-disclosure primitive — the attacker repeatedly triggers the read and collects the out-of-bounds bytes to map kernel memory layout, leak pointers, or defeat ASLR. In a multi-stage chain, the disclosed data is then combined with a secondary primitive (memory corruption or write-what-where) to redirect control flow and execute code in the driver/kernel context. Because the flaw is a read rather than a write, direct code execution from a single trigger is unlikely; the privilege escalation described by Intel is best understood as a building block in an exploitation chain.

4. Post-exploitation impact: Successful exploitation yields code execution at the privilege level of the vulnerable driver — i.e., system/kernel privileges on the target. From that position, an attacker can disable security controls, install persistence (drivers, services, or bootkit components), harvest credentials from memory, and move laterally across the enterprise. Alternatively, if the attacker's goal is disruption, repeatedly triggering the OOB read (or triggering it in a way that raises a fault) produces a driver or system crash, satisfying the high availability impact stated in the NVD description.

Note: the adjacent-access requirement limits exposure to remote internet attackers, but it realistically exposes enterprises through unauthenticated guest SSIDs co-located with corporate networks, and through public Wi-Fi use by roaming laptops.

Impact Assessment

CVSS context: The vendor/NVD record publishes no CVSS vector or score (N/A). The qualitative metrics embedded in the description — adjacent access, low attack complexity, no privileges required, no user interaction, confidentiality low, integrity low, availability high — map to a notional AV:A/AC:L/PR:N/UI:N with C:L/I:L/A:H, but no authoritative vector string exists and one should not be assumed.

Business impact: The primary practical impact is a remotely triggerable denial of service against individual endpoints. An attacker on the same Wi-Fi segment can repeatedly crash the wireless driver or the entire operating system, knocking laptops, thin clients, or industrial devices with Intel Wi-Fi adapters offline. Where a secondary memory-corruption primitive is available, the OOB read enables privilege escalation from an unauthenticated adjacent attacker to kernel-level code execution on a fully patched host.

Affected systems: All endpoints running Intel PROSet/Wireless WiFi Software whose driver version falls within the undisclosed affected set. Intel has not published a version range; therefore, any enterprise fleet containing Intel wireless adapters should be treated as potentially affected until an advisory is released.

Blast radius: The adjacent-network precondition bounds remote exposure but is trivially met in shared wireless environments. Conference networks, airport lounges, guest SSIDs, and compromised IoT devices on the same Wi-Fi network all qualify as adjacent attackers. The downstream consequence — full system compromise of a corporate laptop — carries standard post-exploitation risk for lateral movement and data exfiltration.

Exploitation likelihood: EPSS 0.00172 (6.8th percentile) and the absence of CISA KEV inclusion indicate that widespread in-the-wild exploitation has not been observed. This assessment can change rapidly once technical details of the vulnerable routine are published.

Detection Guidance

The detection content below targets the observable symptoms of this vulnerability class: driver fault/crash events on Windows hosts (the most likely outcome of an OOB read) and anomalous 802.11 management-frame behavior on the adjacent network. Rules must be tuned to local telemetry quality and baseline.

Sigma Rule

title: Intel PROSet Wireless Driver Fault Indicator
id: 3f4d9a6e-c71b-4d82-9e55-8b2f1a0c4975
status: experimental
description: >
  Detects repeated Windows Error Reporting (WER) system events referencing
  Intel PROSet/Wireless WiFi Software, which may indicate attempts to trigger
  CVE-2026-20749 (out-of-bounds read in the Intel wireless device driver).
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 1001
    Provider_Name: Microsoft-Windows-WER-SystemErrorReporting
    Message|contains|all:
      - 'Intel'
      - 'PROSet'
  condition: selection
falsepositives:
  - Genuine driver crashes caused by faulty hardware or outdated driver builds
  - Driver faults unrelated to security events
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-20749

YARA Rule

/*
   YARA rule for asset inventory and incident response triage.
   Flags PE binaries/installers that identify as Intel PROSet/Wireless
   WiFi Software components, helping SOC teams locate hosts that may be
   running the driver affected by CVE-2026-20749.
*/
rule intel_proset_wifi_driver_artifact
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects binaries or installation images associated with Intel PROSet/Wireless WiFi Software (CVE-2026-20749 target component)."
        cve = "CVE-2026-20749"
        date = "2026-05-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20749"

    strings:
        $s1 = "PROSet/Wireless" ascii wide nocase
        $s2 = "PROSet" ascii wide nocase
        $s3 = "Intel WiFi" ascii wide nocase
        $s4 = "Wireless WiFi Software" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and           // MZ header
        filesize < 100MB and
        2 of ($s*)
}

Suricata IDS Rule

# CVE-2026-20749: adjacent-network trigger candidates for the Intel
# PROSet/Wireless WiFi driver OOB read. This rule detects bursts of
# 802.11 deauthentication management frames (frame control 0xC0),
# a common technique for provoking wireless driver fault handling and
# for conducting denial-of-service against Wi-Fi clients.
#
# Sensor requirement: an IDS/NSM probe with an 802.11 monitor-mode
# interface and radiotap/Prism decoding. On a conventional Ethernet
# tap, 802.11 frames are decapsulated by the access point and are not
# visible, so tune the offset accordingly for local capture headers.

alert ether any any -> any any ( \
  msg:"CVE-2026-20749 Possible 802.11 deauth burst targeting Intel PROSet wireless clients"; \
  content:"|C0 00|"; offset:0; depth:2; \
  threshold: type both, track by_src, count 30, seconds 5; \
  classtype:attempted-dos; \
  reference:cve,2026-20749; \
  sid:202620749; rev:1;)

Elastic Detection

// EQL correlation: Intel PROSet/Wireless driver fault events immediately
// followed by a kernel power/bugcheck event on the same host.
// Requires Windows System and WER event telemetry in Elastic.

sequence by host.name with maxspan=10m
  [ any where
      winlog.provider_name == "Microsoft-Windows-WER-SystemErrorReporting" and
      winlog.event_id == 1001 and
      message like "*Intel*" and
      message like "*PROSet*"
  ]
  [ any where
      winlog.provider_name == "Microsoft-Windows-Kernel-Power" and
      winlog.event_id == 41
  ]

Splunk SPL Query

# Primary query: repeated WER entries tied to Intel PROSet/Wireless on
# a single host — a candidate symptom of CVE-2026-20749 exploitation
# or of an attacker inducing driver crashes.

index=windows sourcetype=WinEventLog:System
  EventCode=1001 "Intel" "PROSet"
| stats count as crash_count, dc(_time) as unique_times by host, Message
| where crash_count >= 3
| table _time, host, crash_count, Message

# Secondary query: wireless-clientside network anomaly — hosts on the
# same segment generating large volumes of management/auth frames
# toward a single target (adjacent-access fingerprinting or deauth storms).

index=netwitness index=wireless* OR index=netflow
| stats count by src_ip, dst_ip
| where count > 200
| sort - count

Wazuh OSSEC Rule

<!--
  Wazuh local rule: flags repeated Windows WER events referencing
  Intel PROSet/Wireless WiFi Software, a candidate indicator of
  CVE-2026-20749-related driver OOB read faults.
  Requires Windows event channel (Event ID 1001) mapped by a decoder.
-->
<group name="windows,intel_wireless,">
  <rule id="202607" level="12" frequency="5" timeframe="300" ignore="60">
    <if_sid>601</if_sid>
    <field name="win.system.eventID">1001</field>
    <match>Intel|PROSet</match>
    <description>CVE-2026-20749: repeated Intel PROSet/Wireless WiFi driver faults detected on host</description>
    <group>intel_wireless_driver,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: Patch confidence is 0/4 — the vulnerability is UNPATCHED. No Intel advisory, fixed version, or official workaround exists in any tracked source as of this report. The following measures are compensating controls to be applied until a vendor fix is published.

1. Immediate mitigations

   • Segregate Wi-Fi networks: place guest, BYOD, and public-facing SSIDs on isolated VLANs with no route into corporate segments so that an unauthenticated adjacent attacker cannot sit on the same segment as managed endpoints.
   • Use WPA3-Enterprise / 802.1X with mutual authentication to keep unauthenticated devices off corporate wireless segments entirely.
   • On high-value or lab hosts, disable the wireless adapter when a wired connection is available.
   • Enable host firewall rules that block unsolicited inbound traffic on wireless interfaces.
   • Monitor for the WER/Kernel-Power correlation outlined in the Detection Guidance section and investigate any host exhibiting repeated Intel wireless driver crashes.

2. Patch / upgrade steps

   • Subscribe to Intel Product Security Center notifications and check for a PROSet/Wireless WiFi Software advisory covering CVE-2026-20749; apply the fixed driver as soon as it ships (none exists today).
   • Because no affected-version range is published, treat all currently installed Intel PROSet/Wireless WiFi Software builds as potentially affected and prioritize driver updates for roaming laptops and any device using shared/guest Wi-Fi.
   • Validate new drivers in a pilot group before fleet-wide rollout; verify the driver version against the vendor advisory once it is published.

3. Long-term hardening

   • Adopt a formal wireless security baseline: disable SSID broadcast where possible, enforce 802.1X, disable legacy authentication (WEP/WPA-TKIP), and prohibit client connections to open/untrusted Wi-Fi networks via VPN or split-tunnel policy.
   • Maintain centralized Windows event collection (WER, System, Kernel-Power) to preserve forensic evidence of driver faults; tune the detection rules above to local baselines.
   • Apply the principle of least privilege to local user accounts to reduce the post-exploitation value of a kernel privilege-escalation chain.
   • Re-run EPSS/CISA KEV checks periodically — this CVE is currently unlisted and low-EPSS, but both can change once technical details are disclosed.

References

• NVD entry for CVE-2026-20749: https://nvd.nist.gov/vuln/detail/CVE-2026-20749
• Intel Product Security Center: https://www.intel.com/content/www/us/en/security-center/default.html
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (EPSS score 0.00172, 6.8th percentile): https://www.first.org/epss/

No known threat-actor campaigns or in-the-wild exploitation evidence for CVE-2026-20749 exists in tracked sources as of this report; this assessment is based on the absence of CISA KEV listing and the low EPSS score, and should be re-evaluated when Intel publishes advisory details.