CVE-2026-20795

Executive Summary

CVE-2026-20795 is an unpatched denial-of-service vulnerability in the Ring 2 device-driver layer of Intel(R) PROSet/Wireless WiFi Software for Windows. An adjacent, unauthenticated network adversary can trigger it with a low-complexity attack that requires no user interaction, causing a high availability impact to the affected host and a subsequent low availability impact to dependent systems. No public exploit, patch, or vendor advisory currently exists, and the vulnerability is not listed in CISA KEV; organizations deploying Intel wireless adapters should treat the affected driver stack as unpatched and monitor Intel's security advisory channel.

Technical Analysis

The NVD description attributes this vulnerability to "improper buffer restrictions," which maps to CWE-119 — the failure to properly restrict operations within the bounds of a memory buffer. In practical terms, the Intel PROSet/Wireless WiFi driver does not enforce sufficient bounds validation on input received over the wireless interface, leaving a code path in which an attacker-influenced length, offset, or buffer size can cause an out-of-bounds read or write within driver memory.

The disclosed attack surface is significant in three respects:

1. Adjacent access (AV:A): The adversary must be within radio range of the target. No internet-level exposure, credential, or application-layer access is required. This places the attack surface at the 802.11 radio interface — the driver parses wireless frames before any user-space interaction occurs.
2. No authentication and no user interaction (PR:N / UI:N): The vulnerable parsing path is reachable from an unauthenticated position on the adjacent network. This is consistent with a flaw in the handling of low-level wireless frames that the driver processes pre-association or prior to 802.1X/WPA authentication, rather than in application-layer protocol handling.
3. Low attack complexity (AC:L): The NVD narrative states that no special internal knowledge or attack requirements are needed. The crafted input does not need to defeat mitigations such as ASLR or DEP because the failure occurs at the driver level, where a bounds violation causes a fault rather than requiring precise code execution.

The Intel designation "Ring 2: Device Drivers" reflects Intel's advisory taxonomy for its software components. In the Windows operating model, wireless device drivers run in kernel context; therefore, a memory-corruption fault in this layer can trigger an unhandled exception, a driver reset, or a full operating-system bugcheck. This explains the "high" availability impact to the vulnerable system. The NVD additionally notes a "subsequent system availability (low)" impact — downstream services that depend on the affected host may experience degraded availability after the target is knocked offline.

The NVD credits no CNA title, no affected version range, and no specific driver-file or function identifiers. Accordingly, the exact vulnerable routine, the malformed frame type, and the precise trigger sequence are not publicly known. The analysis above is strictly at the vulnerability-class level (CWE-119) and must not be mistaken for vendor-confirmed implementation detail. The "Ring 2" reference confirms the fault occurs in the driver/device-driver layer rather than in a user-space application component of the PROSet/Wireless software suite.

Exploitation Scenarios

No public PoC or exploit code has been observed for CVE-2026-20795. The attack chain below is inferred strictly from the NVD description and the CWE-119 classification.

Step 1 — Reconnaissance and target identification. The attacker operates from an adjacent position — typically within Wi-Fi range of the target organization, such as a parking lot, adjacent office, or public area. Standard 802.11 passive monitoring tools can identify candidate targets by their MAC address OUIs (Intel-assigned prefixes), by probe-response capabilities, and by observed driver behavior. The attacker does not require credentials or network admission.

Step 2 — Triggering the flaw. The attacker transmits crafted wireless traffic toward the vulnerable Intel PROSet/Wireless WiFi driver. Because the flaw is an improper buffer restriction, the likely mechanism is a frame or protocol field containing an attacker-controlled length or quantity that the driver trusts without adequate bounds checking. The low-complexity, no-user-interaction requirement implies the trigger is delivered in a frame type that the driver processes automatically upon receipt.

Step 3 — Execution at the vulnerability-class level. The driver's parsing routine operates on memory outside an allocated buffer's boundaries — either reading beyond a buffer or writing past it. This corrupts adjacent driver memory, leading to an unhandled exception, a bugcheck (BSOD), or the wireless radio stack entering a non-functional state. No code execution, privilege escalation, confidentiality loss, or integrity impact is described; the consequence is confined to availability.

Step 4 — Post-exploitation impact. The target host crashes, reboots, or loses wireless connectivity. An attacker can repeat the trigger indefinitely, producing a persistent denial of service against the affected endpoint. The NVD's "subsequent system availability (low)" note indicates that services hosted on or dependent on the affected machine may also experience degraded availability during the outage window.

It is acceptable to note explicitly: no public PoC is available, and the attack chain is inferred from the vulnerability class. Specific frame subtypes, driver routine names, and payload structures are not disclosed in the available data.

Impact Assessment

CVSS context. The official CVSS score and vector are published as N/A for this CVE. The descriptive metrics in the NVD narrative — adjacent access, low attack complexity, no privileges, no user interaction, no confidentiality/integrity impact, high availability impact — describe a high-severity, availability-only denial of service. Analysts should map this to their own environmental severity but must not assign the official CVSS vector N/A to a concrete value in reporting.

Affected systems. Any Windows host running Intel(R) PROSet/Wireless WiFi Software — including enterprise laptops, ruggedized field devices, wireless thin clients, and industrial endpoints with embedded Intel Wi-Fi modules. Since no affected version range is disclosed, all current deployments of the software should be considered potentially vulnerable until Intel publishes an advisory.

Business impact. The attack requires only physical/radio proximity, not network access, making it relevant even in environments that are otherwise well-segmented or air-gapped at the IP layer. In retail, healthcare, manufacturing, logistics, and branch-office environments, an adversary could induce recurring device outages across a facility's wireless fleet. Because the driver fault manifests as a system-level crash, even a single targeted device (e.g., a badge-authenticated kiosk or a floor supervisor's tablet) can disrupt a business process until reboot and recovery complete.

Exploitation likelihood. EPSS estimates a 0.00172 probability of exploitation in the wild (6.8th percentile among scored CVEs), indicating low current exploitation activity. The CVE is not present in the CISA Known Exploited Vulnerabilities catalog, and no threat-actor campaigns or exploit-in-the-wild evidence are known. However, the absence of a patch (patch confidence 0/4) means the risk profile will rise as the vulnerability ages and driver-reversing researchers narrow down the vulnerable code path.

Detection Guidance

Detection of this CVE is challenging for two reasons: (1) the trigger occurs over the air at the 802.11 layer, so wired-network IDS/IPS sensors will not observe the malicious frames; and (2) the exact malformed-frame trigger is undisclosed, so signatures cannot target the specific payload. The rules below therefore target the observable effects of the vulnerability class — host crash telemetry, Windows Error Reporting (WER) artifacts, and wireless management-frame anomalies — and should be deployed as part of a layered monitoring strategy alongside wireless intrusion-detection (WIDS) sensors.

Sigma Rule

title: Intel PROSet Wireless WiFi Driver Fault Event - CVE-2026-20795
id: 6f3c25a1-2b7e-4c9f-9a3d-5d0e2f8c1b4a
status: experimental
description: Detects Windows BugCheck and WER crash events referencing Intel PROSet/Wireless WiFi components, which may indicate an attempted adjacent denial of service (CVE-2026-20795).
logsource:
  product: windows
  service: system
detection:
  selection_wer:
    EventID:
      - 1001
      - 1002
  selection_bugcheck:
    EventID:
      - 41
      - 6008
  selection_keywords:
    - 'PROSet'
    - 'Wireless WiFi'
    - 'WLAN'
  condition: (selection_wer or selection_bugcheck) and selection_keywords
falsepositives:
  - Legitimate driver faults caused by hardware failure or power-loss events
level: medium
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-20795

YARA Rule

rule intel_proset_wifi_cve_2026_20795_crash_artifact
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects Windows crash-dump and WER artifacts referencing Intel(R) PROSet/Wireless WiFi drivers, indicative of CVE-2026-20795 adjacent DoS activity."
        cve = "2026-20795"
    strings:
        $s1 = "Intel(R) PROSet/Wireless WiFi" ascii wide
        $s2 = "BugCheck" ascii wide
        $s3 = "WLAN" ascii wide
        $s4 = "PROSet" ascii wide
        $minidump = "PAGEDU64" ascii
        $mz = { 4D 5A 90 00 }
    condition:
        ($minidump at 0 or $mz at 0) and (2 of ($s1, $s2, $s3, $s4))
}

This YARA rule is intended for forensic scanning of collected crash dumps, WER report archives, and memory-capture artifacts. It flags dumps that reference the Intel PROSet/Wireless WiFi product string in combination with bugcheck/error evidence.

Suricata IDS Rule

# NOTE: Deploy this rule on a sensor with an 802.11 monitor-mode interface
# adjacent to the protected WLAN. The exact malformed-frame trigger for
# CVE-2026-20795 is not public; this rule is a volumetric heuristic around the
# disclosed adjacent-access DoS vector (802.11 management-frame flooding).
alert wlan any any -> any any (msg:"CVE-2026-20795 Intel PROSet Wireless WiFi Adjacent DoS - 802.11 Management Frame Flood"; threshold: type both, track by_src, count 200, seconds 10; classtype:attempted-dos; reference:cve,2026-20795; sid:20260795; rev:1;)

Suricata's native 802.11 decoding is limited; for production wireless environments, pair this rule with a dedicated WIDS platform that can perform frame-level anomaly detection. The threshold pattern above flags a single source emitting a high volume of management frames — a common signature of over-the-air DoS activity consistent with the adjacent-access profile of this CVE.

Elastic Detection

EQL query for Windows system event telemetry (Winlogbeat):

any where event.code in ("1001", "1002", "41", "6008") and
  (message like "*PROSet*" or message like "*Wireless WiFi*" or message like "*WLAN*")

EQL sequence for repeated crash behavior within a short window:

sequence by host.name with maxspan=15m
  [ any where event.code == "1001" and message like "*PROSet*" ]
  [ any where event.code == "1001" and message like "*PROSet*" ]

The standalone query surfaces any single wireless-driver crash event; the sequence query escalates when a host experiences repeated faults, which is the expected pattern under an active, repeated DoS attempt.

Splunk SPL Query

index=windows (EventCode=1001 OR EventCode=1002 OR EventCode=41 OR EventCode=6008) ("PROSet" OR "Wireless WiFi" OR "WLAN")
| eval phase=if(EventCode=1001,"WER-BugCheck","System-Event")
| stats count min(_time) max(_time) values(Message) by host, phase
| where count>=2
| convert ctime(*)
| sort - count

If wireless RF telemetry is ingested (e.g., from WIDS or access-point syslog), add the following adjunct query:

index=wireless (deauth OR disassoc OR "management frame")
| bucket _time span=5m
| stats count by src_mac, _time
| where count > 200

The first query identifies hosts exhibiting repeated Intel wireless driver faults. The second correlates those faults with RF-layer management-frame flooding, strengthening the hypothesis of an adjacent, targeted DoS.

Wazuh OSSEC Rule

<group name="windows,cve-2026-20795,">
  <rule id="208795" level="10" frequency="3" timeframe="360">
    <field name="win.system.eventID">^1001$|^1002$|^6008$</field>
    <match>PROSet|Wireless WiFi|WLAN</match>
    <description>CVE-2026-20795: Repeated Intel PROSet/Wireless WiFi driver faults - possible adjacent denial of service</description>
    <group>attack.impact,t1499,</group>
  </rule>
</group>

This rule fires when at least three matching wireless-driver fault events occur within a 360-second window. Adjust the field name attribute to match your Wazuh decoder's mapping for the Windows System event log if your deployment normalizes EventID differently.

Mitigation & Patch Guidance

Patch confidence is 0/4 — the vulnerability is UNPATCHED. No vendor fix, fixed version, or advisory reference exists in any tracked source as of this writing. Do not assume any current build of Intel PROSet/Wireless WiFi Software for Windows is immune.

1) Immediate mitigations (until a patch is available):

• Disable Wi-Fi adapters on systems that can operate on wired Ethernet, especially on business-critical or safety-critical endpoints.
• Restrict physical access to areas within radio range of organizational assets; treat parking lots, lobbies, and adjacent offices as untrusted RF zones.
• Enable 802.11w (Protected Management Frames) and WPA3/802.1X where the infrastructure supports it, which raises the bar for spoofing-based wireless attacks.
• Reduce wireless transmit power on access points and clients where coverage allows, shrinking the adjacent attack radius.
• Implement availability monitoring on wireless fleets so a cluster of driver crashes is alerted as a potential coordinated DoS rather than individual device failures.

2) Patch and upgrade steps:

• Monitor the Intel Security Center for a forthcoming advisory tied to CVE-2026-20795.
• When an advisory is published, validate the fixed driver version and deploy it through Intel Driver & Support Assistant, Windows Update, or enterprise software distribution channels (e.g., WSUS, SCCM).
• After deployment, confirm the installed driver version against Intel's advisory and re-run the detection rules above to verify no further fault events occur.

3) Long-term hardening:

• Centralize wireless-driver version baselining and enforce a driver allowlist to prevent unmanaged driver fallback.
• Deploy a WIDS/WIPS capability to detect RF-layer anomalies, management-frame floods, and spoofed disassociation patterns.
• Integrate host crash telemetry (WER, bugcheck events) into SIEM/SOAR workflows using the detection rules in this report.
• Subscribe to CVE and EPSS feeds for Intel products; revisit the exploitation likelihood for this CVE as it ages — unpatched, adjacent, credential-free DoS vulnerabilities tend to attract exploit development over time.
• Include an RF-based DoS scenario in incident-response tabletop exercises so SOC and physical-security teams are prepared to correlate wireless anomalies with endpoint crash telemetry.

References

• NVD — CVE-2026-20795: https://nvd.nist.gov/vuln/detail/CVE-2026-20795
• Intel Security Center (for the forthcoming advisory): https://www.intel.com/content/www/us/en/security-center/default.html
• MITRE CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-20795 is NOT listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns, exploit-in-the-wild evidence, or public exploit code is associated with CVE-2026-20795 at the time of this report. EPSS score 0.00172 (6.8th percentile) indicates low current exploitation probability; this assessment should be re-evaluated whenever Intel publishes an advisory or security researchers release technical analysis of the vulnerable driver path.