CVE-2026-20778

Executive Summary

CVE-2026-20778 is an out-of-bounds read vulnerability in Intel PROSet/Wireless WiFi Software for Windows, executing in Ring 0 kernel mode. A low-privileged, unauthenticated software adversary positioned on an adjacent network segment may trigger a denial of service condition with high availability impact, while confidentiality and integrity are not affected. No patch, public proof-of-concept, or known exploitation-in-the-wild evidence has been identified at the time of writing, and no affected version range has been published.

Technical Analysis

The vulnerability is classified as CWE-125, Out-of-bounds Read. In general terms, this flaw occurs when a program reads data beyond the bounds of an allocated memory buffer. When the affected code operates in Ring 0, i.e., inside the Windows kernel, such a faulty read can reference invalid or unmapped memory. The resulting kernel access violation typically triggers a Windows bugcheck and an immediate system crash, fitting the described denial of service impact.

The affected component is the Intel PROSet/Wireless WiFi Software for Windows. The NVD description explicitly places the vulnerable operation in the kernel driver stack, which means any memory safety failure in this code can bypass user-mode isolation and corrupt kernel stability, even if it does not necessarily lead to privilege escalation.

The attack model is notable:

• Attack vector: adjacent access — the attacker must be on the same wireless or adjacent network segment; the vulnerability is not directly exploitable over the public internet based on the description.
• Attack complexity: high — exploitation requires specific conditions and is not trivially reliable.
• Privileges required: unprivileged software adversary; no authentication is required.
• User interaction: none.
• Internal knowledge: none required.
• Security impact: confidentiality none, integrity none, availability high.

The NVD description does not disclose the exact affected function, driver name, frame type, or parsing routine. It is therefore not possible to provide a code-level trace of the vulnerable instruction. From a vulnerability-class perspective, the most plausible mechanism is that the kernel driver receives specially crafted input via an adjacent wireless or kernel interface and performs an out-of-bounds memory read while processing that input. Because the driver is in Ring 0, the read may fault the kernel, causing a blue screen or unplanned reboot.

No affected versions are listed, no vendor fix has been announced, and no public exploit code has been observed. The lack of technical detail limits the ability to build a byte-level detection signature; detection guidance below therefore focuses on observable system crash telemetry and generic CVE reference indicators.

Exploitation Scenarios

The following attack chain is inferred strictly from the NVD data. Specific frame layouts and internal driver calls are not publicly available and are not invented here.

1. Reconnaissance and target identification
   The attacker identifies Windows hosts running Intel PROSet/Wireless WiFi Software. Because access is adjacent, this likely involves being in physical proximity to a target Wi-Fi network or already having a presence on the same Layer 2 segment. No internal knowledge of the target is required.

2. Triggering the out-of-bounds read
   The attacker sends or manipulates crafted wireless traffic from an adjacent position. The exact input format is not documented in public CVE data. The out-of-bounds read is triggered when the Intel kernel driver processes this malformed or unexpected input. Because no user interaction is required, the trigger can be automated or repeated.

3. Payload and execution method
   The "payload" is the malformed input itself. There is no indication of arbitrary code execution; the impact is limited to an invalid kernel read that causes a system fault or bugcheck. The attack succeeds when the kernel attempts to read beyond a buffer boundary and crashes the system.

4. Post-exploitation impact
   The primary post-exploitation effect is denial of service. The victim system becomes unavailable and may reboot. There is no confidentiality or integrity impact, so data exfiltration or modification should not be expected. An attacker can repeat the attack to maintain prolonged unavailability. Since exploitation requires high complexity, the reliability may vary across hardware and driver versions.

No public PoC is available, and the attack chain is inferred from the vulnerability class and the NVD description.

Impact Assessment

The available CVSS vector is N/A; however, the NVD description explicitly defines the security impact as:

• Confidentiality impact: none
• Integrity impact: none
• Availability impact: high

This means the primary risk is endpoint availability degradation. For enterprise fleets, a successful exploit could cause recurring crashes on laptops, industrial terminals, or other systems using Intel PROSet/Wireless WiFi Software. The blast radius is limited to the affected host, but an attacker who can repeatedly trigger the flaw from an adjacent wireless position could cause targeted or broad wireless client outages in a physical location.

The attack requires access to the adjacent network and is rated as high complexity, which lowers the likelihood of mass exploitation. The EPSS score of 0.00148, at the 4.5 percentile of exploited CVEs, also suggests low current exploitation activity. The absence of a CISA KEV entry further indicates that no known exploitation is being tracked by CISA.

The most significant concern is the unpatched status. With no vendor fix available and no affected version range disclosed, defenders cannot easily determine which systems are exposed. Until a fix is released, every instance of Intel PROSet/Wireless WiFi Software for Windows must be treated as potentially at risk.

Detection Guidance

The public data for CVE-2026-20778 does not include a packet-level signature or driver-level identifier. The following detection rules are therefore best-effort telemetry signatures focused on post-exploitation artifacts, specifically Windows bugcheck and unexpected shutdown events, as well as generic indicators of files referencing this CVE. These rules should be validated and tuned in a production environment.

Sigma Rule

title: Windows Kernel BugCheck Possibly Related to Intel PROSet Wireless CVE-2026-20778
id: 06c3b4a1-72d9-4f6c-bf5e-9b2d2c0e7f10
status: experimental
description: >
  Detects Windows bugcheck (Event ID 1001) and unexpected shutdown (Event ID 6008)
  events that may be associated with CVE-2026-20778, an out-of-bounds read in
  Intel PROSet/Wireless WiFi Software for Windows. This is a broad post-crash
  indicator, not a byte-level exploit signature.
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID:
      - 1001
      - 6008
  condition: selection
falsepositives:
  - Hardware failures, memory corruption, power loss
  - Unrelated third-party driver crashes
level: medium
tags:
  - attack.t1499
  - cve.2026-20778
  - cwe.125

YARA Rule

rule cve_2026_20778_intel_proset_reference
{
    meta:
        author = "Valters IT Cyber Threat Intelligence"
        description = "Detects files referencing CVE-2026-20778 and Intel PROSet Wireless, including proof-of-concept scripts, notes, or downloaded advisory files."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20778"
        cve = "2026-20778"
    strings:
        $cve = "CVE-2026-20778"
        $vsn = "PROSet/Wireless WiFi Software"
        $kw1 = "out-of-bounds read"
        $kw2 = "Ring 0"
        $kw3 = "kernel"
    condition:
        $cve and $vsn and 1 of ($kw1, $kw2, $kw3)
}

Suricata IDS Rule

alert wlan any any -> any any (msg:"ET EXPLOIT Possible Intel PROSet Wireless CVE-2026-20778 OOB Read Attempt"; wlan_frame_type:management; reference:cve,2026-20778; classtype:attempted-dos; sid:20260778; rev:1; metadata:created_at 2026-06-01, updated_at 2026-06-01;)

This rule is an anomaly template for environments capable of decoding 802.11 frames. Because the exact trigger frame type is not public, it should be correlated with endpoint bugcheck events rather than used as a standalone block rule.

Elastic Detection

sequence by host.name with maxspan=10m
  [ any where event.code == "1001" and message like "*bugcheck*" ]
  [ any where event.code == "6008" and event.module == "system" ]

This EQL sequence groups a Windows bugcheck report followed by an unexpected shutdown event for the same host. Analysts should manually correlate results with hosts that have Intel PROSet/Wireless WiFi Software installed.

Splunk SPL Query

index=windows source="WinEventLog:System" EventCode IN (1001, 6008)
| stats earliest(_time) as first_seen latest(_time) as last_seen count as crash_count by host
| sort - crash_count

The query identifies hosts with kernel bugcheck and unexpected shutdown activity. Tune the search by adding the Intel or PROSet keyword to the raw event message only if the environment contains sufficient Intel log telemetry.

Wazuh OSSEC Rule

<group name="windows,system,denialofservice,">
  <rule id="434364" level="10">
    <decoded_as>windows</decoded_as>
    <field name="win.system.eventID">1001</field>
    <description>Windows bugcheck (Event ID 1001) - possible Intel PROSet/Wireless CVE-2026-20778 kernel denial of service</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_20778,</group>
  </rule>

  <rule id="434365" level="8">
    <if_sid>20260778</if_sid>
    <regex>Intel|PROSet|Wireless</regex>
    <description>Intel PROSet/Wireless signature observed in bugcheck context - possible CVE-2026-20778</description>
  </rule>

  <rule id="434366" level="8">
    <field name="win.system.eventID">6008</field>
    <description>Unexpected system shutdown observed - correlate with Intel PROSet/Wireless CVE-2026-20778</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence has been found from any tracked source. Affected versions are unknown, and no vendor fix or workaround has been published.

1. Immediate mitigations

   • Treat all current Intel PROSet/Wireless WiFi Software for Windows installs as potentially exposed.
   • Restrict wireless network access to trusted users and devices; enable enterprise Wi-Fi authentication (e.g., WPA3-Enterprise or 802.1X) to reduce the ability of unauthenticated adjacent attackers to inject traffic.
   • For fixed workstations, prefer wired Ethernet if wireless connectivity is not business-critical.
   • Monitor Windows System event logs for repeated Event ID 1001 and Event ID 6008 entries, especially on laptops and devices with Intel wireless adapters.
   • Enforce local least privilege; the adversary model includes an unprivileged software adversary, so limiting local code execution reduces the local attack surface.

2. Patch and upgrade steps

   • No vendor patch is currently available.
   • Subscribe to Intel security advisory notifications for PROSet/Wireless WiFi Software for Windows.
   • Inventory all Windows hosts with Intel wireless drivers and maintain a list of driver versions. Apply the vendor-supplied update as soon as it is released.
   • Until a patch exists, avoid using unofficial beta driver packages or third-party driver update tools.

3. Long-term hardening

   • Enable Windows kernel crash dumps and collect minidumps for forensic analysis of bugcheck events.
   • Use Windows Error Reporting and event log forwarding to centralize crash telemetry.
   • Segment guest, IoT, and untrusted wireless networks away from corporate endpoints.
   • Harden wireless configuration: disable legacy protocols, enable protected management frames, and use authenticated encryption-capable Wi-Fi standards.
   • Maintain a driver security baseline for all endpoint fleet images.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-20778
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-20778
• CWE-125 Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK Technique T1499: https://attack.mitre.org/techniques/T1499/
• FIRST EPSS: https://www.first.org/epss/

No vendor advisory, public exploit code, or known threat actor campaigns were identified for CVE-2026-20778 at the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.