CVE-2026-20878

Executive Summary

CVE-2026-20878 is an unpatched NULL pointer dereference (CWE-476) in some Intel PROSet/Wireless WiFi Software for Windows device drivers. An unauthenticated network adversary within wireless radio range can trigger a denial of service with low attack complexity and no user interaction, crashing the wireless driver or the host system. Impacts are limited to availability (high for the vulnerable system, low for subsequent system state); confidentiality and integrity are not affected. No public exploit has been observed and the CVE is not listed in CISA KEV, but with patch confidence of 0/4, affected enterprises currently have no vendor-supplied fix available.

Technical Analysis

The vulnerability is a NULL pointer dereference (CWE-476) located in the device driver component of Intel(R) PROSet/Wireless WiFi Software for Windows (identified in the disclosure as "Ring 2: Device Drivers"). In this flaw class, a driver reaches a code path where a pointer is assumed to be valid, dereferences it, and the pointer is NULL — causing a kernel-mode fault, a system bugcheck (BSOD), or a fatal driver crash. The availability impact of that crash is rated high by the disclosure.

The NVD description tells us the attack is performed by a "network adversary with an unauthenticated user" via "adjacent access." This strongly implies the trigger is delivered over the air to the target's wireless network interface — the attacker does not need credentials, network access beyond radio range, or any user interaction such as opening a file or visiting a URL. The attack complexity is low, meaning the adversary does not require special internal knowledge or unusual preparation to succeed.

Insufficient technical detail is available in the public description to name specific functions, frame types, or parsing routines. At the vulnerability-class level, the most plausible mechanism is that a crafted or malformed 802.11 frame (management, control, or data) is parsed by the wireless driver. A parsing/validation path fails to check a pointer before dereferencing it; the driver then faults. Because the defect lives in a device driver handling over-the-air input, any Intel WiFi client within radio range of an attacker broadcasting the malicious frames is potentially affected. The absence of authentication requirements on 802.11 management frames — which are processed before any association or authentication completes — is the likely reason "unauthenticated" adjacent attackers can trigger the flaw. Note that this is an inferred mechanism consistent with the disclosure, not a confirmed implementation detail.

Attack surface: the wireless radio interface of every system running an affected version of Intel PROSet/Wireless WiFi Software for Windows. Devices that do not use the vulnerable adapter or have Wi-Fi physically disabled are not exposed to the adjacent-access vector.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-476 NULL pointer dereference in a wireless driver triggered by an adjacent attacker) and the sparse NVD description. No function names, frame layouts, or implementation details are asserted beyond what the description supports.

1. Reconnaissance / target identification: The adversary deploys a wireless-capable device within radio range (e.g., a rogue AP, a laptop in monitor mode, or a software-defined radio). Passive scanning identifies nearby clients and access points. The attacker can fingerprint the target's Wi-Fi adapter/driver stack through probe-response behavior, supported 802.11 capabilities/information elements, or other observable driver artifacts; success depends on identifying hosts running Intel PROSet/Wireless WiFi Software for Windows. At this stage the attacker needs no credentials and no interaction from the victim.

2. Flaw trigger: With the target identified, the attacker transmits crafted 802.11 frames toward the target client. Because the vulnerable condition is a NULL pointer dereference in driver code that processes incoming wireless frames, the frames must be structured to reach the buggy validation path — likely containing fields or sub-elements that the driver parses but does not fully validate. The attacker repeats the transmission as needed; low complexity means no special internal knowledge of the driver is required, only the ability to send frames and observe the effect.

3. Execution / payload delivery: The payload is the malformed frame series itself. On receipt, the driver parses the data and dereferences a NULL pointer in an error or normalization routine. The result is a kernel-mode exception in the wireless driver: the adapter resets, the Wi-Fi stack faults, or the operating system bugchecks (Blue Screen of Death). The attack is interaction-free — the victim does not click, open, or approve anything.

4. Post-exploitation impact: The impact is denial of service. The target loses wireless connectivity and possibly full system availability until a driver reload or system reboot. The adversary can repeat the trigger to keep the victim offline, and can replay the attack against multiple targets in radio range. Because the NULL dereference occurs in kernel/driver context, there is a residual risk of system instability beyond the Wi-Fi function (the disclosure rates subsequent system availability as low). Confidentiality and integrity are not impacted; the attacker gains no code execution, data access, or persistence from this flaw class alone.

Impact Assessment

Affected systems are enterprise and consumer Windows endpoints using Intel Wi-Fi adapters with the PROSet/Wireless WiFi Software driver stack installed — a broad installed base across laptops, desktops, and industrial clients. The attack is remotely triggerable but only by an adversary physically located in radio range (adjacent access), which reduces but does not eliminate exposure: any untrusted person inside a building, parking lot, or neighboring office with basic wireless equipment can attempt the attack.

Business impact is focused on availability. A reliable adjacency-reachable DoS against unpatched Intel WiFi endpoints could disrupt operations in environments that depend on wireless connectivity (warehouse scanners, laptops in open-plan offices, retail point-of-sale terminals). Repeated exploitation forces constant reboots, interrupts user productivity, and can aggregate into a partial endpoint outage. There is no data loss, confidentiality breach, or integrity compromise from this CVE.

CVSS scoring details were not published (CVSS score/vector: N/A), so subscore analysis is not possible. The qualitative rating from the disclosure — confidentiality none, integrity none, availability high (with subsequent system availability low) — aligns with a medium-to-high severity denial-of-service profile. The EPSS score is 0.00219 (12.7th percentile of exploited CVEs), indicating a low current likelihood of in-the-wild exploitation. However, the unpatched status (patch confidence 0/4) means the window of exposure is open indefinitely; if a PoC is published, exploitation likelihood can rise quickly. The CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no threat actor campaigns or exploit-in-the-wild evidence were identified for this report.

Detection Guidance

Because optical/network-level visibility into the malicious 802.11 frames is rarely available to enterprise monitoring (the attack occurs at the wireless PHY/MAC layer before the packet reaches a monitored wired segment), the most reliable detection signals are host-side crash artifacts: Windows BugCheck events, driver errors, and repeated unexpected system restarts. The rules below are heuristics for detecting the outcome of a CVE-2026-20878 exploitation attempt, and should be tuned to the environment.

Sigma Rule

title: Intel PROSet/Wireless WiFi Driver Crash - CVE-2026-20878
id: 7d2c3e4f-1a2b-4c5d-9e8f-0a1b2c3d4e5f
status: experimental
description: Detects Windows BugCheck (Event ID 1001) events where the failure signature references Intel wireless/WLAN drivers, a likely outcome of CVE-2026-20878 NULL pointer dereference triggered by an adjacent attacker.
logsource:
  product: windows
  service: system
detection:
  selection_bugcheck:
    EventID: 1001
    Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
  selection_intel:
    Message|contains|all:
      - 'Intel'
      - 'WLAN'
  condition: selection_bugcheck and selection_intel
  timeframe: 10m
level: high
falsepositives:
  - Legitimate Intel driver crashes unrelated to CVE-2026-20878 (power events, hardware faults)
tags:
  - attack.impact
  - attack.t1499
  - cve.2026-20878
  - cwe.476

YARA Rule

rule CVE_2026_20878_Intel_PROSet_WiFi_Driver_DoS
{
    meta:
        author = "Valters IT SOC"
        description = "Detects PE files or artifacts referencing CVE-2026-20878, an unpatched NULL pointer dereference in Intel PROSet/Wireless Wi-Fi device drivers."
        cve = "CVE-2026-20878"
        cwe = "CWE-476"
        date = "2026-02-14"
    strings:
        $a = "CVE-2026-20878" ascii wide nocase
        $b = "PROSet/Wireless" ascii wide nocase
        $c = "Intel" ascii wide nocase
        $d = "denial of service" ascii wide nocase
        $e = "null pointer" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and ( $a or ( $b and $c and ($d or $e) ) )
}

Suricata IDS Rule

# Note: standard enterprise sensors rarely see 802.11 management traffic.
# This rule detects the adjunct wireless denial-of-service pattern
# (management frame flood from a single source) commonly used to deliver
# or complement driver-crash payloads. Requires a capture interface
# capable of decoding 802.11 (e.g., with radiotap/tap interface).
alert wlan any any -> any any (msg:"CVE-2026-20878 Intel PROSet/Wireless adjacent DoS - management frame flood"; wlan_frame_type:0; wlan_frame_subtype:8; threshold:type both, track by_src, count 500, seconds 10; classtype:attempted-dos; reference:cve,2026-20878; sid:5208781; rev:1;)

Elastic Detection

// Correlates a Windows WER BugCheck referencing Intel/WLAN with an
// unexpected shutdown (Event 6008) within 10 minutes - strong indicator
// of repeated adjacent-triggered driver crashes (CVE-2026-20878).
sequence by host.name with maxspan=10m
  [ any where event.code == "1001" and winlog.provider_name == "Microsoft-Windows-WER-SystemErrorReporting"
      and message like "*Intel*" and message like "*WLAN*" ]
  [ any where event.code == "6008" and winlog.provider_name == "Microsoft-Windows-Eventlog" ]

Splunk SPL Query

index=windows source="XmlWineventlog:System" (EventCode=1001 Provider_Name="Microsoft-Windows-WER-SystemErrorReporting" "Intel" "WLAN")
OR (EventCode=41 Provider_Name="Microsoft-Windows-Kernel-Power")
| stats count, values(EventCode) as EventCodes, latest(_time) as LastSeen by host
| table host, count, EventCodes, LastSeen
| where count > 1

Wazuh OSSEC Rule

<group name="windows,system,">
  <rule id="100208" level="12">
    <if_sid>18100</if_sid>
    <field name="win.system.eventID">^1001$</field>
    <regex>Intel.*WLAN</regex>
    <description>Windows crash with Intel WLAN driver signature - possible CVE-2026-20878 NULL pointer dereference denial of service</description>
    <group>cve_2026_20878,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: As of this report, CVE-2026-20878 has a patch confidence of 0/4 — no patch evidence exists from any tracked source, no vendor fix has been published, and no workarounds have been issued by Intel. Treat the vulnerability as open and monitor the Intel Security Center for advisory updates targeting PROSet/Wireless WiFi Software for Windows.

1) Immediate mitigations (no patch available):

• Where business operations allow, disable or uninstall the Wi-Fi radio on systems that do not require wireless connectivity; use wired Ethernet as the primary transport.
• Segment wireless clients onto a dedicated VLAN and treat the Wi-Fi airspace as an untrusted boundary; assume any person within radio range is a potential attacker.
• Harden wireless configuration: use WPA3-Enterprise/802.1X where possible to reduce the number of unauthenticated peers that can interact with clients, and disable open/legacy networks in the vicinity where feasible.
• Deploy the host-side detection rules above (Sigma/Elastic/Splunk/Wazuh) and alert on repeated Intel WLAN crash signatures (BugCheck Event 1001, Event 41, Event 6008) from the same host.
• Confirm with endpoint management teams which device models/driver packages in your fleet actually ship Intel PROSet/Wireless WiFi Software; inventory the affected adapter population.

2) Patch/upgrade steps (when vendor fix is available):

• Monitor Intel's official security advisory feed and the Intel Download Center for a fixed PROSet/Wireless WiFi Software release; do not apply third-party or unsigned driver packages.
• Stage the fixed driver in a pilot group using your endpoint management tool (WSUS, Intune, SCCM, or vendor update channel), verify stability, then deploy fleet-wide.
• Enforce driver update policy so that future Intel WiFi driver revisions are delivered automatically and rapidly after Intel publishes them.

3) Long-term hardening:

• Maintain a current, consolidated driver baseline for all wireless adapters and audit it quarterly.
• Restrict physical access to building perimeters and use wireless intrusion prevention systems (WIPS) to detect rogue/adjacent transmitters attempting frame floods.
• Include crash-event telemetry (BugCheck, kernel-power) in your SIEM correlation playbooks so driver-level DoS attempts are visible even when the network layer cannot see the 802.11 frames.
• Reassess the CISA KEV listing and EPSS score periodically; if a public PoC emerges, raise alerting priority and consider temporary radio shutdown policy for high-value assets.

References

1. NVD Entry — CVE-2026-20878: https://nvd.nist.gov/vuln/detail/CVE-2026-20878
2. Intel Security Center (vendor advisory page — monitor for future fix): https://www.intel.com/content/www/us/en/security-center/default.html
3. MITRE CWE-476 (NULL Pointer Dereference): https://cwe.mitre.org/data/definitions/476.html
4. CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS Score for CVE-2026-20878 (0.00219): https://www.first.org/epss/

No threat actor campaigns, in-the-wild exploitation evidence, or public proof-of-concept code associated with CVE-2026-20878 was identified in the tracked sources at the time of writing.