CVE-2026-24099

Executive Summary

CVE-2026-24099 is a use-after-free vulnerability in Intel PROSet/Wireless WiFi Software for Windows that occurs in the kernel ("Ring 0: Kernel"). A local, unauthenticated adversary can leverage the flaw to trigger a denial of service, crashing or destabilizing the affected Windows system with no user interaction required. The vulnerability has a high availability impact, no confidentiality or integrity impact, and currently has no confirmed patch, public exploit, or known in-the-wild activity.

Technical Analysis

The vulnerability is classified as CWE-416 (Use After Free). In the context of Intel PROSet/Wireless WiFi Software for Windows, the affected component operates at Ring 0, meaning the code runs with kernel privilege inside a WiFi driver or related kernel module.

A use-after-free occurs when a program continues to reference a memory object after that object has been freed. In kernel-mode software, this type of memory lifecycle error can lead to:

• Access to invalid memory pointers.
• Corruption of kernel memory pools.
• Unhandled kernel exceptions, typically resulting in a Blue Screen of Death (BSOD) or forced system reboot.

Per the NVD description, the attack is characterized by:

• System software adversary: The threat actor targets system-level software.
• Unauthenticated user: No prior authentication on the target is required, only local access.
• High complexity attack: Successful exploitation depends on non-trivial timing, state, or memory layout conditions.
• No user interaction: The victim does not need to perform any action.
• No special internal knowledge: The attacker does not require deep proprietary knowledge of the vulnerable component.

The NVD record does not disclose specific affected driver names, file paths, function names, or an exact attack vector. The public description is therefore insufficient to reconstruct the precise vulnerable code path. From a vulnerability-class perspective, the likely mechanism is a race condition between freeing an internal configuration object or packet buffer and a subsequent wireless operation — for example, a scan, connect, disconnect, or power-state transition — that dereferences the stale pointer.

Because the flaw is in Ring 0, any memory corruption is immediately safety-critical. Even though the impact is limited to denial of service rather than privilege escalation or code execution, a local attacker who repeatedly triggers the bug can cause recurring system instability and service interruption.

Exploitation Scenarios

No public proof-of-concept is currently available. The attack chain below is inferred from the NVD description and the vulnerability class (CWE-416).

1. Reconnaissance / target identification
   The attacker identifies a Windows system that has Intel PROSet/Wireless WiFi Software installed. This can be achieved by observing installed WiFi drivers, adapter names, or system management telemetry, but such reconnaissance is not strictly required — the attacker can attempt exploitation on any system with Intel wireless hardware.

2. Triggering the vulnerability
   The attacker triggers the affected wireless driver functionality through local interfaces exposed to unauthenticated users. Because the attack requires no user interaction and no special internal knowledge, the likely method involves issuing specific WiFi-related operations in quick succession to create a race condition. Examples at the vulnerability-class level include initiating scans, reconnecting to a wireless network, toggling the adapter, or entering/exiting low-power states.

3. Payload / execution method
   This is a memory lifecycle defect, not a code-injection vulnerability. The attacker does not upload a kernel payload. Instead, the repeated or timed invocation of driver operations causes the driver to free a kernel object and then access it again, triggering an invalid memory access. The kernel reports a fatal error and terminates the system to prevent further corruption.

4. Post-exploitation impact
   The immediate impact is a denial of service: the Windows machine crashes or reboots. Confidentiality and integrity are unaffected. Repeated exploitation can be used to keep a system unavailable, disrupt critical workflows, or prevent a competitor/tenant from using a shared endpoint. There is no indication of privilege escalation or remote code execution from this CVE.

Impact Assessment

The NVD record does not provide a CVSS base score or vector; the CVSS value is N/A. Qualitative impact is specified as:

• Confidentiality: None
• Integrity: None
• Availability: High

Because the vulnerable code runs in Ring 0: Kernel, the availability impact applies to the entire operating system, not just the wireless stack or one user session. A kernel crash caused by the use-after-free will terminate all running processes and require a reboot.

The attack surface is limited to local access. However, "unauthenticated user" means any user who can log in locally, execute code at the user level, or interact with the system through a local service can attempt the attack. In environments with shared workstations, kiosks, or remote desktop access, the effective exploitation surface is broader.

The EPSS score is 0.00132, and the CVE is in the 3.2% percentile of exploited CVEs — indicating a very low current likelihood of exploitation in the wild. This may change once Intel discloses more technical details or a researcher publishes an analysis.

Detection Guidance

Detection is challenging because no public exploit or network indicator is available. The following rules are intended to detect artefacts of the vulnerability: kernel crash events associated with Intel WiFi components, files or network payloads referencing CVE-2026-24099, and unusual local activity around Intel PROSet/Wireless components.

Sigma Rule

title: Intel PROSet Wireless Kernel Crash Indicator
status: experimental
description: Detects Windows Error Reporting events or kernel crash events referencing Intel PROSet/Wireless WiFi components, potentially related to CVE-2026-24099.
logsource:
  product: windows
  service: application
detection:
  selection:
    EventID:
      - 1000
      - 1001
    Provider_Name:
      - Windows Error Reporting
    Message|contains:
      - "PROSet"
      - "PROSet/Wireless"
      - "Intel WiFi"
      - "Wifi"
  condition: selection
falsepositives:
  - Benign WiFi driver crashes unrelated to CVE-2026-24099
level: medium

YARA Rule

rule Intel_PROSet_CVE_2026_24099_Reference
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects files or payloads referencing CVE-2026-24099 and Intel PROSet/Wireless WiFi Software."
        cve = "2026-24099"
    strings:
        $cve = "CVE-2026-24099" ascii wide
        $prod1 = "PROSet/Wireless WiFi" ascii wide
        $prod2 = "Intel(R) PROSet" ascii wide
        $prod3 = "Ring 0: Kernel" ascii wide
        $prod4 = "Intel WiFi" ascii wide
    condition:
        $cve and any of ($prod*)
}

Suricata IDS Rule

Network detection for a local kernel driver flaw is inherently limited. This rule alerts when a HTTP payload contains both the CVE reference and Intel PROSet/Wireless identifiers, which may indicate an exploit document or tool delivery attempt.

alert http any any -> any any (msg:"CVE-2026-24099 Intel PROSet WiFi DoS reference in HTTP body"; flow:established,to_client; content:"CVE-2026-24099"; http_server_body; content:"PROSet"; http_server_body; content:"Intel"; http_server_body; classtype:attempted-dos; reference:cve,2026-24099; sid:202624099; rev:1;)

Elastic Detection

EQL query to identify Windows Error Reporting entries referencing Intel WiFi components after a possible kernel crash.

any where event.code in ("1000", "1001") and winlog.provider_name == "Windows Error Reporting" and (message like "*PROSet*" or message like "*Intel WiFi*" or message like "*Wifi*")

Splunk SPL Query

index=windows source="WinEventLog:Application" (EventCode=1000 OR EventCode=1001) (message="*PROSet*" OR message="*Intel WiFi*" OR message="*CVE-2026-24099*")
| stats count min(_time) max(_time) by host source EventCode message
| where count > 0

Wazuh OSSEC Rule

<group name="windows, intel_wifi,">
  <rule id="240990" level="10">
    <if_sid>5000000</if_sid>
    <field name="win.eventdata.eventID">1000|1001</field>
    <match>PROSet|PROSet/Wireless|Intel WiFi|CVE-2026-24099</match>
    <description>Possible CVE-2026-24099 exploitation indicator: Intel PROSet/Wireless WiFi kernel crash or exploit reference</description>
    <group>intel_wifi_dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor patch, fixed version, or official workaround has been identified from any tracked source. Intel has not released an advisory with corrective actions as of the time of this report.

1. Immediate mitigations

   • Restrict local console and interactive access to systems with Intel PROSet/Wireless WiFi Software to trusted users only.
   • Disable the WiFi adapter when wired connectivity is available or when wireless functionality is not required.
   • Monitor systems for repeated crash events, abnormal reboots, and Windows Error Reporting entries referencing Intel WiFi drivers.
   • Isolate high-value endpoints from shared physical access (kiosks, training rooms, shared labs).

2. Patch / upgrade steps

   • No fixed version is currently available. Subscribe to Intel Product Security Center advisories and monitor for an update to Intel PROSet/Wireless WiFi Software.
   • When a patch is published, deploy it through the enterprise software management and firmware/driver update pipeline.
   • Until then, any reported driver crash affecting Intel WiFi should be treated as potentially related to this CVE and investigated.

3. Long-term hardening

   • Maintain a rigorous driver lifecycle process; never allow end users to install unsigned or outdated WiFi drivers.
   • Enable Windows crash dump collection and integrate WER/Event Log telemetry into the SIEM for faster detection of kernel-level fault patterns.
   • Apply the principle of least privilege. An unauthenticated local adversary should not be able to interact with low-level hardware interfaces; where possible, limit local logon rights on shared machines.
   • Evaluate hardware alternatives for sensitive environments if Intel PROSet/Wireless WiFi Software is considered high-risk and unpatched for an extended period.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-24099
• CVE.org Record: https://cve.org/CVERecord?id=CVE-2026-24099
• Intel Product Security Center: https://www.intel.com/content/www/us/en/security-center/default.html
• FIRST EPSS: https://www.first.org/epss/search?cve=CVE-2026-24099
• CISA KEV Catalog — not listed (verified as of reporting date)

No known threat actor campaigns or exploit-in-the-wild evidence was available at the time of writing. The CVE is not present in the CISA Known Exploited Vulnerabilities catalog, and no public exploit code or Nuclei template was identified.