CVE-2026-20787

Executive Summary

CVE-2026-20787 is an unpatched null pointer dereference vulnerability (CWE-476) in the device drivers of Intel(R) PROSet/Wireless WiFi Software for Windows. An unauthenticated network adversary positioned within adjacent wireless range can trigger a denial of service with low attack complexity and no user interaction, causing the affected system's wireless driver (and likely the host OS) to crash. The vulnerability impacts only availability — confidentiality and integrity are not compromised — and as of this report, no vendor patch, public exploit, or CISA KEV listing exists, leaving nearby-reachable Intel Wi-Fi clients exposed.

Technical Analysis

The vulnerability is a classic null pointer dereference (CWE-476) present in the kernel-mode driver layer (described as "Ring 2: Device Drivers") of Intel's PROSet/Wireless WiFi Software for Windows. A null pointer dereference occurs when a program or driver attempts to read from or write to a memory address mapped to NULL (0x0) without first validating that the pointer is non-null. In kernel-mode device-driver context, this is a fatal condition: the Windows kernel raises a bugcheck (commonly experienced as a Blue Screen of Death), terminating all system services and forcing a reboot.

The NVD description characterizes the preconditions as follows:

• Attack Vector — Adjacent Access (AV:A): The attacker must be within radio range of the target's Wi-Fi adapter. This is an 802.11/WLAN-class attack surface rather than an Internet-reachable one.
• No Authentication / No User Interaction: The "network adversary with an unauthenticated user" language indicates the trigger can be delivered without valid credentials on the wireless network and without any action from the victim.
• Low Complexity: The attack does not require special internal knowledge or unusual attack requirements.
• Impact — Availability High: The primary impact is the crash of the vulnerable system; confidentiality and integrity impact are none.

The specific implementation detail — which 802.11 frame type, which parsing routine, and which driver buffer — is not disclosed in the NVD description or CNA title. Insufficient technical detail is available to name the vulnerable function. However, the conditions strongly suggest the flaw exists in a code path that processes wireless input before or during association/authentication, since an "unauthenticated user" is sufficient. The absence of user interaction further implies the malicious frame is handled automatically by the driver's protocol stack.

From a privilege-model perspective, device drivers in Windows execute with kernel privileges. A null pointer dereference at this layer does not yield memory-corruption code execution in the typical case (no integrity impact is claimed) but causes a kernel fault that halts the entire operating system. From an attacker's point of view, this is a reliable, low-cost crash primitive: repeatedly re-triggering the fault produces persistent denial of service.

Exploitation likelihood metrics remain low: the EPSS score is 0.00172 (6.8th percentile of exploited CVEs), meaning there is currently little evidence of real-world exploitation. This low score should be weighed against the fact that the vulnerability is unpatched; risk will increase over time as reverse engineering of the driver becomes more practical and as public interest grows.

Exploitation Scenarios

No public PoC exists and exploit code has not been observed in the wild; the following attack chain is inferred strictly from the vulnerability class (CWE-476 null pointer dereference in a wireless driver) and the NVD description's preconditions.

1. Reconnaissance / Target Identification: The attacker positions himself within Wi-Fi range of a target environment (e.g., a corporate campus or a public venue). Using commodity wireless monitoring tools, the attacker identifies nearby stations whose clients are running Intel wireless adapters. Because the driver is part of Intel PROSet/Wireless WiFi Software, any Windows laptop, tablet, or IoT device with an Intel Wi-Fi chipset is a candidate. No prior credentials, physical access, or user interaction are required.

2. Triggering the Flaw Class: The attacker crafts and transmits 802.11 frames designed to reach the vulnerable parsing path inside the driver. Because the NVD description specifies an unauthenticated adversary, the responsible code path likely executes prior to a successful handshake — for example, during management frame (probe, beacon, association) processing or during pre-authentication scanning. The driver's parser dereferences a pointer without a null check; the crafted frame forces the vulnerable branch to execute with NULL as the target pointer.

3. Payload / Execution Method (Vulnerability-Class Level): At the class level, the "payload" is simply a malformed or maliciously sequenced wireless frame that drives the vulnerable parser into the null-pointer state. No code execution payload is required and none is implied — the impact is a crash. The attack is repeated as needed to produce a target system bugcheck.

4. Post-Exploitation Impact: The target system crashes and reboots (availability high at the system level). The NVD description additionally notes subsequent system availability impact of low severity, likely reflecting that the crash is recoverable via reboot but can be re-triggered on demand. An attacker can repeatedly force reboot loops, effectively removing the affected machine from the network — a meaningful disruption for conference rooms, mobile workforces, OT-adjacent laptops, and any environment depending on Wi-Fi-connected Windows endpoints.

Note: No public PoC available; the attack chain above is inferred from the vulnerability class and published preconditions, not from observed exploit code.

Impact Assessment

Business Impact: The vulnerability enables a denial-of-service condition against any Windows endpoint using Intel PROSet/Wireless WiFi drivers. In an enterprise context, an attacker in vicinity of a building — parking lot, adjacent office, or common area — could systematically crash employee laptops, preventing them from joining video calls, accessing cloud services, or authenticating. For high-availability environments (hospitals, manufacturing floors, logistics), crashing wireless clients can disrupt workflows even if wired infrastructure remains intact.

Affected Systems: Endpoints with Intel Wireless adapters running Intel PROSet/Wireless WiFi Software for Windows. The affected version list is empty at time of writing, so the exposure window potentially spans all currently shipping Intel Wi-Fi driver builds.

Blast Radius: The attack is constrained by RF range (adjacent access), which limits the attacker to physical proximity but extends beyond a single room. The impact is single-system denial of service; there is no confidentiality or integrity loss, and the attacker does not gain code execution, data access, or persistence. The NVD description assigns high availability impact to the vulnerable system and low availability impact to subsequent system behavior — consistent with a crash-and-reboot cycle rather than permanent hardware or firmware destruction.

CVSS Context: The CNA has not published a CVSS score or vector; therefore, CVSS remains N/A. Qualitative analysis of the NVD description (adjacent access, low complexity, no privileges, no user interaction, availability high) aligns with a medium-to-high severity DoS vulnerability whose practical impact is amplified by the lack of a patch.

Detection Guidance

Detection is primarily host-based (crash telemetry, Windows Event Logs, and endpoint agent data), because the vulnerability lives in a wireless driver and no network-identifiable signature has been published. The network rule below is a heuristic for anomalous 802.11 activity that may precede a driver crash.

Sigma Rule

title: Intel PROSet Wireless WiFi Driver BugCheck – CVE-2026-20787
id: f3a9c2e0-1a5d-4b7c-9e6f-8c1d2a3b4c5d
status: experimental
description: Detects Windows Error Reporting (WER) bugcheck events referencing Intel PROSet/Wireless WiFi Software, consistent with a null pointer dereference in the wireless device driver (CVE-2026-20787).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-20787
author: ValtersIT Threat Intelligence
date: 2026/06/14
logsource:
    product: windows
    service: application
detection:
    selection_event:
        EventID: 1001
    selection_provider:
        Provider_Name:
            - 'Windows Error Reporting'
            - 'Microsoft-Windows-WER-SystemErrorReporting'
    selection_keywords:
        - 'Intel'
        - 'PROSet'
        - 'Wireless WiFi'
    condition: selection_event and selection_provider and selection_keywords
falsepositives:
    - Driver crashes caused by firmware bugs, outdated drivers, or hardware faults
level: medium

YARA Rule

rule CVE_2026_20787_Intel_PROSet_WiFi_CrashArtifacts
{
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-06-14"
        description = "Detects crash dump and log artifacts referencing Intel PROSet/Wireless WiFi Software, associated with CVE-2026-20787 null pointer dereference DoS."
        cve = "CVE-2026-20787"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-20787"
    strings:
        $s1 = "Intel(R) PROSet/Wireless WiFi" ascii wide
        $s2 = "PROSet/Wireless WiFi Software" ascii wide
        $s3 = "Wireless WiFi" ascii wide
        $s4 = "Intel Wireless" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

# Heuristic network-layer rule: CVE-2026-20787 is a driver-level flaw with
# no published frame signature. This rule flags excessive 802.11 management
# frames from a single source, a common precursor to wireless driver DoS.
alert wifi any any -> any any (msg:"CVE-2026-20787 Potential Intel PROSet Wireless WiFi Driver DoS - 802.11 Management Frame Flood"; \
  wlan.fc.type eq 0; \
  threshold: type threshold, track by_src, count 600, seconds 10; \
  classtype:attempted-dos; \
  reference:cve,2026-20787; \
  sid:2026879; rev:1;)

Elastic Detection

sequence by host.name with maxspan=10m
  [ any where event.code == "1001" and
      wildcard(message, "*Intel*") and
      wildcard(message, "*PROSet*") ]
  [ any where event.code == "41" and
      winlog.provider_name == "Microsoft-Windows-Kernel-Power" ]

This EQL sequence correlates a Windows Error Reporting bugcheck referencing Intel PROSet/Wireless with a subsequent unexpected shutdown (Kernel-Power Event 41), indicating the driver crash resulted in a full system reboot.

Splunk SPL Query

index=windows earliest=-7d
  (EventCode=1001 OR EventCode=6008 OR EventCode=41)
  (Message="*Intel*" OR Message="*PROSet*" OR Message="*Wireless WiFi*")
| stats count by host, EventCode, Message
| table host, EventCode, Message, count
| sort - count

This query surfaces all crash-related event IDs mentioning Intel PROSet/Wireless WiFi across the environment, allowing analysts to quickly identify hosts exhibiting repeated wireless-driver crashes.

Wazuh OSSEC Rule

<group name="windows,intel_proset_wifi,">
  <rule id="100387" level="12" frequency="5" timeframe="600">
    <if_sid>18100</if_sid>
    <match>Intel|PROSet|Wireless</match>
    <description>CVE-2026-20787: Repeated Intel PROSet/Wireless WiFi driver crash events — possible denial-of-service exploitation attempt.</description>
    <group>windows,cve-2026-20787,</group>
  </rule>
</group>

The rule triggers when five Windows event log entries containing Intel/PROSet/Wireless references occur within 10 minutes, indicating a crash loop consistent with an ongoing DoS attempt.

Mitigation & Patch Guidance

Patch Status: Patch confidence is 0/4 — UNPATCHED. No vendor fix, advisory, or patched driver version has been identified from any tracked source. Intel has not yet published an update for CVE-2026-20787 as of this report.

1) Immediate Mitigations:

• Restrict access to the RF medium: since the attack requires adjacent wireless access, limit who can associate to your SSIDs. Enforce 802.1X/EAP-TLS where the infrastructure supports it. Note that the NVD description implies the flaw may trigger pre-authentication, so this reduces but may not eliminate exposure.
• Use wired (Ethernet) connections for critical or high-availability endpoints and for any system that does not strictly require Wi-Fi.
• Disable the wireless adapter on unattended servers, kiosks, and other fixed-function devices.
• Monitor endpoint crash telemetry using the detection rules above and investigate any pattern of repeated Intel wireless driver bugchecks.

2) Patch / Upgrade Steps:

• Continuously monitor Intel's Security Center and the Intel PROSet/Wireless WiFi Software download page for an updated driver that addresses CVE-2026-20787.
• Once a fixed driver version is released, stage and test it in a pilot group, then deploy via enterprise driver-management channels (e.g., WSUS, Intune, Windows Update for Business, SCCM driver packages) to all affected Windows endpoints.
• Record the driver version baseline before and after rollout to verify the vulnerable build has been fully replaced.

3) Long-Term Hardening:

• Establish a formal wireless-driver update cadence; do not wait for security incidents to trigger driver refreshes.
• Enforce Windows driver-signature policies and use a dedicated group policy to restrict which driver versions can be installed.
• Deploy a Wireless Intrusion Prevention System (WIPS) to detect management-frame floods and anomalous RF behavior that may indicate attempts to trigger wireless-driver vulnerabilities.
• Reassess risk periodically against CISA's Known Exploited Vulnerabilities catalog (CVE-2026-20787 is currently NOT listed) and FIRST EPSS data (current EPSS: 0.00172, 6.8th percentile). If exploitation activity increases or a public PoC emerges, elevate this CVE to priority patching status.
• Segment wireless networks from critical production segments so that even a successful DoS on a wireless client does not disrupt core services.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-20787
• Intel Security Center (vendor advisory index — no specific advisory published yet): https://www.intel.com/content/www/us/en/security-center/default.html
• MITRE CWE-476 (NULL Pointer Dereference): https://cwe.mitre.org/data/definitions/476.html
• FIRST EPSS (score for CVE-2026-20787): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20787 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat-Actor / Exploit-in-the-Wild Notes: No known threat-actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept code have been identified for CVE-2026-20787 at the time of this report. The CVE is not present in CISA KEV, and the low EPSS percentile (6.8%) confirms minimal observed exploitation pressure. However, the unpatched status means the exposure window is open-ended, and the adjacent-access requirement makes it most relevant to organizations where physical proximity to wireless clients is possible.