CVE-2026-20780

Executive Summary

CVE-2026-20780 is an unpatched, locally exploitable denial-of-service vulnerability in the kernel driver layer ("Ring 2: Device Drivers") of Intel PROSet/Wireless WiFi Software for Windows. An unprivileged, unauthenticated local adversary can trigger uncontrolled resource consumption (CWE-400) in the affected Wi-Fi driver with low attack complexity and no user interaction, causing high availability impact on the host while leaving confidentiality and integrity unaffected. No public proof-of-concept, known in-the-wild exploitation, or vendor patch exists at the time of writing, so organizations running affected Intel wireless driver stacks should rely on access control and monitoring as interim controls.

Technical Analysis

The NVD description characterizes CVE-2026-20780 as an uncontrolled resource consumption condition (CWE-400) present in "some" Intel PROSet/Wireless WiFi Software for Windows builds, within the component the CNA labels "Ring 2: Device Drivers." This places the flaw in the kernel-mode Wi-Fi driver stack rather than in the user-mode configuration utilities that ship with the same software package. Intel's CNA template uses "Ring 2" to designate the driver layer; in the x86 protection model this corresponds to kernel-mode code, meaning a failure here has direct access to the core operating system state.

The vulnerability mechanism is resource exhaustion rather than memory corruption. An adversarial process running without administrative privileges can reach the affected driver interface through normal Windows driver I/O pathways (device object open/close operations, scan-request handling, or power/connection state transitions). The description explicitly states that no special internal knowledge is required and that attack requirements are "not present," which indicates the vulnerable code path is reachable by default in a standard local session. Because the attack is low complexity, requires no user interaction, and can be repeated, a single unprivileged process can drive the driver into a state of unbounded resource consumption — for example, unbounded memory allocation or sustained CPU spinning — until the driver stops servicing requests.

The impact profile stated in the description is confidentiality: none, integrity: none, availability: high at the driver level, with a "subsequent" system-level availability impact rated low. This two-tier impact is consistent with a driver crash or hang that first kills the wireless stack (loss of Wi-Fi connectivity) and then degrades overall platform responsiveness, potentially forcing an unplanned reboot. No data exposure or tampering is implied by the vulnerability class. Notable caveats: the exact affected version range is not disclosed ("some" installations), no CVSS vector string was published (value N/A), and no patch or vendor advisory has been observed. The EPSS score of 0.00129 (2.9th percentile of exploited CVEs) confirms that exploitation activity, if any, is currently negligible, and the CVE is absent from the CISA Known Exploited Vulnerabilities catalog.

Exploitation Scenarios

No public PoC is available for CVE-2026-20780; the attack chain below is inferred from the vulnerability class (CWE-400 uncontrolled resource consumption) and the NVD description, which specifies local access, low complexity, an unprivileged/unauthenticated user, and no user interaction.

1. Reconnaissance / target identification. The attacker requires a foothold on a Windows endpoint that has Intel PROSet/Wireless WiFi Software with an affected driver installed. Presence of the package can be enumerated from the local session through standard software inventory data (installed programs list, driver metadata, or visible Wi-Fi management tray components). Because the affected component is a driver, the attacker does not need to identify a network-exposed service or perform remote fingerprinting.

2. Flaw trigger. The attacker invokes operations that exercise the vulnerable driver code path. At the vulnerability-class level, this means issuing a high volume of driver requests — repeatedly opening and closing the Wi-Fi device interface, triggering association/scan cycles, or forcing connection state changes. The absence of a "special internal knowledge" requirement means a generic unprivileged loop over ordinary driver operations should suffice to begin exhausting resources.

3. Payload / execution method. No external payload delivery is involved; this is a logic-level exhaustion attack, not a memory-safety exploit. An effective payload would be a script or compiled utility that issues driver requests in a tight loop faster than the driver releases associated resources. The absence of a PoC means the precise request pattern is unknown, but for CWE-400 the controlling factor is rate and persistence of requests rather than a specific malformed input.

4. Post-exploitation impact. Successful triggering leaves the Wi-Fi driver in a hung or continuously failing state. The host loses wireless connectivity, and the cascading low-level system availability impact can manifest as input lag, service timeouts, or an unresponsive OS requiring reboot. If the OS attempts automatic driver recovery, the attacker can restart the request loop to force a crash loop, sustaining the denial of service indefinitely. There is no privilege escalation, data exfiltration, or lateral movement component; the objective is purely availability sabotage of a single host or of a fleet of fleet endpoints if locally replicated.

Impact Assessment

The business impact of CVE-2026-20780 is concentrated entirely on availability. The affected asset class is any Windows endpoint running an affected version of the Intel PROSet/Wireless WiFi Software driver — including enterprise laptops, convertible devices, and IoT/industrial gateways that rely on Intel Wi-Fi modules. Because the attack requires local access, the vulnerable system is not remotely exploitable over the network, which meaningfully constrains the blast radius to the local host. However, in environments with shared workstations, kiosk sessions, or malware already present on endpoints, an unprivileged process can act as the trigger, so any untrusted code execution on an affected host is a sufficient precondition.

From a CVSS qualitative standpoint — noting that no formal vector was published (N/A) — the description maps to a local, low-complexity, unauthenticated/unprivileged attack with no user interaction and an availability subscore of High, with a subsequent system availability impact of Low. Confidentiality and integrity are unaffected. The EPSS probability score of 0.00129 indicates a low but non-zero likelihood of exploitation in the near term, and CISA has not added this CVE to the KEV catalog, meaning no confirmed exploitation-in-the-wild has been reported. The most significant operational risk is a malicious insider or low-privilege malware persistently disabling Wi-Fi connectivity on fleets of mobile endpoints, causing productivity loss, missed connectivity SLAs, and increased support/reboot overhead. No data confidentiality or integrity risk is introduced by this CVE itself.

Detection Guidance

Detection of CVE-2026-20780 is inherently host-centric; the attack is local and leaves no network payload signature. The rules below focus on (a) anomalous bursts of Intel PROSet/Wireless-related process activity, (b) repeated driver fault/error events in Windows logs, and (c) abrupt termination of network sessions consistent with a driver crash. Analysts should treat these rules as hunting aids with moderate fidelity; none of them have been validated against a real exploit sample because no public exploit exists.

Sigma Rule

title: Intel PROSet Wireless Driver Resource Exhaustion Attempt
id: 67d3c1a2-9f4e-4b1a-8c2d-cve202620780
status: experimental
description: Detects a burst of Intel PROSet/Wireless WiFi related process executions
  or driver fault events consistent with CWE-400 uncontrolled resource consumption
  targeting CVE-2026-20780.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-20780
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|contains:
      - 'Intel'
    CommandLine|contains:
      - 'PROSet'
      - 'Wireless'
      - 'WiFi'
  timeframe: 60s
  condition: selection | count() by Image > 30
  level: medium
falsepositives:
  - Legitimate Intel PROSet update or repair utilities running in a loop
  - Enterprise software deployment agents executing Intel utilities repeatedly
---
title: Intel Wireless Driver Fault Event Spike
id: 77d3c1a2-8f4e-4c1a-9d2c-cve202620780b
status: experimental
description: Detects a high frequency of Windows system/application event log messages
  referencing Intel PROSet/Wireless WiFi driver errors, a post-condition of a
  CVE-2026-20780 resource exhaustion attack.
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name|contains: 'Intel'
    Message|contains:
      - 'PROSet'
      - 'Wireless'
      - 'driver'
  timeframe: 10m
  condition: selection | count() by Computer > 50
  level: medium

YARA Rule

rule intel_proset_wifi_cve_2026_20780_hunt
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Hunting rule for Intel PROSet/Wireless WiFi driver and utility artifacts potentially targeted by CVE-2026-20780. No public samples exist; matches on metadata and embedded strings."
        cve = "CVE-2026-20780"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20780"
        date = "2026-01-01"
    strings:
        $s1 = "Intel(R) PROSet/Wireless" ascii nocase
        $s2 = "PROSet" ascii nocase
        $s3 = "Wireless WiFi" ascii nocase
        $s4 = "WiFi" ascii nocase
        $v1 = "CompanyName" ascii
        $v2 = "Intel" ascii
    condition:
        uint16(0) == 0x5A4D and filesize < 50MB and
        (all of ($s1, $s2, $s3) or (all of ($s2, $s3, $s4) and $v1 and $v2))
}

Note: because no exploit or malicious sample is publicly available, this YARA rule targets legitimate driver/utility binaries for triage and inventory correlation rather than malware. Analysts should pivot on any anomalous copies (unexpected locations, unsigned, modified metadata).

Suricata IDS Rule

Network-based detection is of limited value for a local driver DoS, but the following rule observes the post-exploitation footprint: a burst of TCP resets/connection teardowns indicative of a host whose wireless driver has crashed.

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-20780 possible Intel PROSet wireless driver crash - connection teardown burst"; flags: R; flow: established; threshold: type both, track by_dst, count 100, seconds 10; classtype:attempted-dos; sid:20260780; rev:1;)

Operational caveat: legitimate network churn and scanners can produce RST bursts; base-rate false positives are expected unless correlated with host-side Intel wireless driver fault events. Use the rule strictly as a correlation signal for "host dropped off the network abruptly."

Elastic Detection

# EQL 1: Spike of Intel PROSet/Wireless process executions (1-minute window)
process where event.category == "process" and event.action == "process-start"
    and process.executable : "*Intel*"
    and (process.command_line : "*PROSet*" or process.command_line : "*Wireless*" or process.command_line : "*WiFi*")

# EQL 2: Windows event log entries referencing Intel wireless driver failures
any where event.provider : "*Intel*"
    and (message : "*PROSet*" or message : "*Wireless*" or message : "*driver*")

For higher fidelity in Elastic Security, enable a custom detection that counts EQL 1 results per host over a 1-minute window with a threshold of 30+ executions; this matches a resource-exhaustion request loop that frequently manifests as repeated invocations of the Wi-Fi management CLI or driver reload helpers.

Splunk SPL Query

index=windows (sourcetype="WinEventLog:System" OR sourcetype="WinEventLog:Application")
| where match(message, "(?i)Intel.*(PROSet|Wireless|WiFi)")
| bucket _time span=10m
| stats count as driver_events by host, _time, EventCode
| where driver_events > 50
| sort - driver_events

index=windows sourcetype="WinEventLog:Security" EventCode=4688
| rename NewProcessName as process_exec
| where match(process_exec, "(?i)Intel.*(PROSet|Wireless|WiFi)")
| bucket _time span=1m
| stats count as proc_events by host, _time, process_exec
| where proc_events > 20

Tune thresholds to environment baselines. Pair either query with a host-level CPU/memory observation query on wlansvc/Intel driver processes to correlate resource exhaustion with system degradation.

Wazuh OSSEC Rule

<group name="windows,">
  <rule id="100310" level="10" frequency="15" timeframe="60">
    <decoded_as>windows</decoded_as>
    <match>Intel(R) PROSet/Wireless</match>
    <regex>driver|Wireless|WiFi</regex>
    <description>CVE-2026-20780: Repeated Intel PROSet/Wireless WiFi driver fault events - possible uncontrolled resource consumption (DoS)</description>
    <group>windows,availability,</group>
  </rule>
</group>

The frequency="15" and timeframe="60" attributes implement a 15-events-per-60-seconds threshold, which should be tuned per host baseline. The rule is intentionally broad on message content because the exact vulnerable driver symbol names have not been disclosed.

Mitigation & Patch Guidance

Patch confidence is 0/4 — the vendor has not released a fix, and no affected/fixed version ranges or vendor workarounds are available from any tracked source. Until an advisory is published, apply the following layered controls:

1. Immediate mitigations. Restrict local access to affected Windows endpoints — remove unnecessary local accounts, enforce strong authentication for interactive sessions, and disable guest/anonymous logon. Enforce application allowlisting so unprivileged users cannot execute arbitrary script/loop utilities. Where feasible, disable wireless adapter power management and auto-scan features via Group Policy to reduce the reachable attack surface, while acknowledging this does not close the vulnerability.

2. Patch/upgrade steps. Subscribe to Intel Security Center notifications for CVE-2026-20780 and monitor the NVD page (referenced below). When Intel publishes a fixed build of Intel PROSet/Wireless WiFi Software, stage and deploy it through the enterprise driver management pipeline (e.g., SCCM, Intune, WSUS or a dedicated driver catalog), then verify driver versions across the fleet. Do not install unsigned or third-party driver replacements.

3. Long-term hardening. Maintain a hardware/software inventory of all endpoints with Intel Wi-Fi modules to scope impact the moment a patch ships. Centralize Windows event and process telemetry (Windows Event Log, Sysmon, EDR) so the detection rules above can be tuned against per-host baselines. Segment critical assets and consider wired connectivity for high-availability systems if wireless reliability is a business requirement. Re-assess CISA KEV status and EPSS trends periodically; while currently no exploitation is known, the unpatched and local-privilege profile makes this a candidate for insider and low-privilege malware use.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-20780
2. CWE-400 Uncontrolled Resource Consumption — https://cwe.mitre.org/data/definitions/400.html
3. Intel Security Center (vendor advisory index — no CVE-specific advisory yet) — https://www.intel.com/content/www/us/en/security-center/default.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of writing) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS Score for CVE-2026-20780 — https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, or independent researcher publications were identified for this CVE at the time of writing.