CVE-2026-22887
Executive Summary
CVE-2026-22887 is an improper buffer restrictions vulnerability in Intel(R) PROSet/Wireless WiFi Software for Windows. The flaw exists in kernel/Ring 0 context and can be triggered by an unprivileged software adversary from an adjacent network position with low attack complexity and no user interaction, resulting primarily in denial of service. No patch is currently available from any tracked source, and no public exploit code or CISA KEV listing has been identified.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Technical Analysis
The NVD description identifies CVE-2026-22887 as an improper buffer restrictions issue within the Ring 0 kernel component of Intel(R) PROSet/Wireless WiFi Software for Windows. This maps to CWE-119, which describes improper restriction of operations within the bounds of a memory buffer. In practical terms, the affected driver or kernel component fails to correctly constrain buffer operations when processing certain input, potentially leading to out-of-bounds memory access, kernel memory corruption, and ultimately a system fault such as a blue screen / stop error.
Attack characteristics from the NVD description are important:
- Attack vector: Adjacent access — the trigger input is delivered from a logically adjacent network position, consistent with a wireless or local network attack surface.
- Preconditions: The attack is described as low complexity and requiring no special internal knowledge. Attack requirements are not otherwise present, suggesting a stable and repeatable trigger condition.
- Authentication/prerequisites: The adversary is described as an unprivileged software actor with an unauthenticated user context. No user interaction is required.
- Impact profile: Confidentiality impact is none; integrity impact is low; availability impact is high. This is consistent with a memory-corruption denial-of-service vulnerability rather than a memory-corruption code-execution or privilege-escalation primitive.
No specific vulnerable function, driver object, IOCTL code, or exact packet structure is disclosed in the NVD description or CNA title. As a result, the vulnerable code path cannot be identified from public data. However, the presence of “Ring 0: Kernel” indicates that the faulty logic resides in a kernel-mode component of the WiFi software stack. A flaw of this class in a kernel driver is typically triggered by malformed or oversized input delivered to a device interface or parsed by the WiFi stack, leading to a buffer boundary violation and subsequent kernel fault.
Because the vulnerability is in WiFi software and the attack vector is adjacent access, it is plausible that the trigger is reachable over the wireless medium, although the exact protocol layer or parsing path is not confirmed by the available data. Enterprise SOCs should treat this as a kernel-level denial-of-service flaw affecting systems that run Intel PROSet/Wireless WiFi Software for Windows.
Exploitation Scenarios
No public proof of concept exists, so the following attack chain is inferred from the vulnerability class, CWE-119, and the NVD impact description. Specific implementation details should not be assumed beyond what the description provides.
Reconnaissance / target identification
An attacker with adjacent network access — for example on the same Wi-Fi network or within wireless range — identifies a Windows endpoint that has Intel PROSet/Wireless WiFi Software installed. This may be accomplished by passive fingerprinting of wireless drivers, observing network device identifiers, or using administrative tooling on the local segment. In a local-access scenario, the attacker may already have unprivileged software execution on the host or nearby network.Triggering the vulnerability class
The attacker delivers a crafted input that is processed by the vulnerable WiFi software stack inside the Windows kernel. Because the issue is improper buffer restrictions, the malicious input likely exploits a boundary condition — either an undersized or malformed buffer that is interpreted beyond its declared length. Because the attack is described as low-complexity and requiring no special internal knowledge, this input can probably be reproduced without deep reverse engineering.Execution and fault generation
The malformed input causes the Ring 0 component to perform an out-of-bounds memory access. The result is kernel memory corruption or an invalid memory reference. In most kernel buffer restriction failures, this leads to a bugcheck/stop error, forcibly restarting the system. Since no user interaction is required, the attack can be repeated to produce sustained denial of service.Post-exploitation impact
The primary post-exploitation consequence is loss of availability: the affected endpoint crashes or becomes unusable until reboot. The NVD description rates availability impact as high, integrity impact as low, and confidentiality impact as none. This indicates the attacker is unlikely to read sensitive data or gain long-term persistence; the value of the vulnerability lies in disrupting operations.
Impact Assessment
The business impact of CVE-2026-22887 is primarily operational availability. Enterprise devices running Intel PROSet/Wireless WiFi Software for Windows — including laptops, tablets, and some wireless-enabled desktops — are potentially exposed to a crash loop or single-event denial of service from an adjacent attacker. Because the attack vector is adjacent, remote internet attackers are not directly in scope; however, any untrusted wireless network segment, guest Wi-Fi network, or shared local environment can be a viable exploitation surface.
The NVD impact description maps to a confidentiality impact of none, integrity impact of low, and availability impact of high. No CVSS vector string was provided in the source data, but the qualitative scoring indicates high severity from an availability standpoint. The integrity sub-score is low, meaning an attacker may be able to corrupt targeted memory contents but is unlikely to achieve reliable data modification. A repeatable crash could be weaponized as a targeted denial-of-service capability against specific users in a wireless environment.
Blast radius is currently constrained by the lack of a public exploit. If weaponized, each affected host is individually targetable; no lateral propagation or network-wide compromise is indicated by the data. The absence of a patch increases risk for organizations that cannot quickly restrict adjacent network exposure.
Detection Guidance
No official IoCs, exploit samples, or leaked payloads are available. Detection logic must focus on observable side effects — repeated driver faults, kernel bugchecks referencing Intel WiFi software, and anomalous crash dumps. The following rules are generic and should be tuned to local environment baselines.
Sigma Rule
title: Intel PROSet/Wireless WiFi Kernel BugCheck / DoS Attempt
id: 0e5d8a2f-2287-4c1e-9d3a-aa11b2cc2287
status: experimental
description: Detects Windows BugCheck events referencing Intel PROSet/Wireless WiFi software, potentially indicating CVE-2026-22887 exploitation or crash conditions.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2026-22887
tags:
- attack.impact
- attack.t1499
logsource:
product: windows
service: system
detection:
selection:
EventID: 1001
Provider_Name: 'Microsoft-Windows-WER-SystemErrorReporting'
keywords:
- 'Intel'
- 'PROSet'
- 'WIFI'
- 'WLAN'
condition: selection and keywords
falsepositives:
- Non-security related wireless driver instability
- Hardware faults involving Intel WiFi adapters
- Routine system bugchecks unrelated to CVE-2026-22887
level: high
YARA Rule
rule intel_proset_wifi_cve_2026_22887
{
meta:
description = "Detects artifacts referencing Intel PROSet/Wireless WiFi Software, potentially related to CVE-2026-22887"
author = "Valters IT Threat Intelligence"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-22887"
date = "2026"
strings:
$s1 = "Intel" ascii nocase
$s2 = "PROSet" ascii nocase
$s3 = "WiFi" ascii nocase
$s4 = "CVE-2026-22887" ascii nocase
$s5 = "WLAN" ascii nocase
condition:
uint16(0) == 0x5A4D and 3 of ($s*)
}
Suricata IDS Rule
# Note: CVE-2026-22887 is adjacent-oriented and likely operates at or below the
# wireless layer. Network IDS coverage is opportunistic; endpoint telemetry is primary.
alert ip any any -> any any (msg:"CVE-2026-22887 Intel PROSet/Wireless WiFi DoS Probe"; content:"Intel"; nocase; content:"PROSet"; nocase; content:"WiFi"; nocase; reference:cve,2026-22887; classtype:attempted-dos; sid:202622887; rev:1;)
Elastic Detection
any where event.code == "1001" and
(message like "*Intel*" or message like "*PROSet*" or message like "*WiFi*")
This EQL query searches the Windows system event stream for BugCheck / Windows Error Reporting events where the message references the affected vendor or product family. Organizations may extend it by correlating with host restart timestamps and repeated crash events to detect sustained denial-of-service attempts.
Splunk SPL Query
index=windows SourceName="Microsoft-Windows-WER-SystemErrorReporting" EventCode=1001 ("Intel" OR "PROSet" OR "WiFi" OR "WLAN")
| eval cve_id=if(match(Message, "CVE-2026-22887"), "CVE-2026-22887", "UNKNOWN")
| stats count min(_time) as first_seen max(_time) as last_seen by host, cve_id, Message
| where count >= 2
| sort - count
Wazuh OSSEC Rule
<group name="windows,system,denial_of_service,">
<rule id="228871" level="10">
<if_group>windows</if_group>
<field name="win.system.eventID">1001</field>
<regex>Intel|PROSet|WiFi|WLAN</regex>
<description>Possible CVE-2026-22887 exploitation resulting in Intel PROSet wireless kernel crash</description>
<group>attack.t1499,</group>
</rule>
</group>
Mitigation & Patch Guidance
Patch confidence is 0/4 — no patch evidence was found from any tracked source, and Intel has not published a fix or advisory for CVE-2026-22887. The risk cannot currently be fully remediated by a vendor update. The following actions should be considered:
Immediate mitigations
- Restrict access to trusted wireless networks; discourage the use of public or untrusted adjacent networks for high-value Windows endpoints.
- Where feasible, use wired network connections for critical systems until a patch is available.
- Disable the Intel PROSet/Wireless WiFi adapter on systems that do not require wireless connectivity.
- Segment guest and bring-your-own-device Wi-Fi networks away from corporate systems to reduce adjacent attack surface.
- Monitor for repeated Windows BugCheck events (Event ID 1001) involving Intel WiFi components and investigate any clusters of crashes.
Patch / upgrade steps
- Continuously monitor Intel’s security advisory channels for an update to Intel PROSet/Wireless WiFi Software for Windows.
- Once an updated version is released, deploy it through enterprise software management tooling to all affected hosts.
- Validate driver version consistency across the environment and prioritize systems that are exposed to guest Wi-Fi or other untrusted adjacent networks.
Long-term hardening
- Enable Windows memory integrity / HVCI (Hypervisor-protected Code Integrity) where hardware and drivers permit; this can reduce the impact of kernel memory-corruption issues.
- Use endpoint detection and response platforms that can alert on repeated crash events and anomalous driver behavior.
- Maintain strict patch/update standing for WiFi firmware and drivers, not just the PROSet application layer.
- Limit unprivileged software installation on sensitive hosts, since the NVD description indicates the attacker may leverage unprivileged software execution.
At the time of writing, there are no known in-the-wild campaigns specifically linked to CVE-2026-22887. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. The EPSS score of 0.00172 indicates a relatively low current exploitation likelihood, but the unpatched status and low-complexity characteristics argue for continued monitoring.
References
- NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-22887
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: https://cwe.mitre.org/data/definitions/119.html
- MITRE ATT&CK — Endpoint Denial of Service: T1499: https://attack.mitre.org/techniques/T1499/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- FIRST EPSS — CVE lookup: https://www.first.org/epss/
No vendor advisory link is included because no official Intel advisory was identified in the supplied data. No threat-actor campaign or exploit-in-the-wild evidence is available for this CVE at the time of writing.