CVE-2026-24911

Executive Summary

CVE-2026-24911 is an unpatched stack-based buffer overflow (CWE-121) in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows. An unauthenticated, unprivileged attacker with adjacent network access — i.e., within radio range of the target — can trigger a denial of service without user interaction, crashing the affected system. No public proof-of-concept, vendor patch, or evidence of in-the-wild exploitation has been reported at the time of writing; mitigation is currently limited to network-level isolation and host hardening controls.

Technical Analysis

The NVD description characterizes CVE-2026-24911 as a stack-based buffer overflow affecting "some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel." This places the vulnerable logic in a kernel-mode component of the Intel WiFi software stack, which is responsible for processing 802.11 wireless traffic and interfacing with the Windows networking subsystem. A buffer overflow of this class occurs when data received from an adjacent wireless link is copied into a fixed-size stack buffer without adequate bounds validation. An overlong value — typically a length field, element, or payload embedded in a wireless management or control frame — overruns the stack buffer, corrupting adjacent stack metadata such as the saved return address, frame pointer, or stack canary.

Because the vulnerable component executes at Ring 0 (kernel privilege), a triggered overflow generally results in an unrecoverable exception or bugcheck, terminating the operating system session. The NVD description explicitly constrains the impact to availability: confidentiality is rated "none," integrity is rated "none," and availability is rated "high." This strongly suggests the observable outcome is a system crash or reboot rather than code execution or privilege escalation, although kernel-mode memory corruption of this class can, in principle, produce arbitrary code execution if an attacker obtains a reliable corruption primitive. No such capability is asserted in the available data.

The description also specifies the attack prerequisites: an "unprivileged software adversary with an unauthenticated user," a "low complexity attack," "adjacent access," "attack requirements are not present without special internal knowledge," and "no user interaction." In CVSS 4.0 terminology, this corresponds qualitatively to Attack Vector: Adjacent, Attack Complexity: Low, Privileges Required: None, User Interaction: None, and an availability-only (High) impact profile. No affected version range, driver module name, function name, or specific frame type is disclosed in the description, so the precise vulnerable code path and trigger frame cannot be enumerated. Insufficient technical detail is available to attribute the flaw to a specific 802.11 frame parser.

Exploitation Scenarios

No public PoC or exploit code is available, so the following attack chain is inferred from the vulnerability class (stack-based buffer overflow in a kernel-mode WiFi driver reachable from an adjacent network position).

1. Reconnaissance / target identification: The attacker must identify a host that is running the affected Intel PROSet/Wireless WiFi Software and is within radio range. Passive techniques include observing the target's wireless adapter MAC OUI (Intel-assigned OUIs), probing for Intel-specific wireless capabilities, or simply targeting a venue — corporate office, conference hall, airport, or public Wi-Fi — where Windows hosts with Intel Wi-Fi adapters are known to operate. No credentials or prior access are required.

2. Triggering the flaw: The attacker positions a radio transmitter within the target's wireless coverage area and transmits a crafted 802.11 frame (or series of frames) containing an anomalous field length or malformed element. Because the flaw is reachable via "adjacent access" with no user interaction, the victim does not need to click, authenticate, or assist in any way. The target's wireless adapter receives the frame and processes it in the vulnerable Ring 0 component before any meaningful validation occurs.

3. Payload / execution method at the class level: The crafted frame exploits the missing bounds check in the stack buffer copy, overflowing the buffer with attacker-controlled data. At the vulnerability-class level, the overflow corrupts stack memory in kernel context. Depending on compiler mitigations (e.g., stack canaries, kernel ASLR), the corruption either triggers an immediate exception/bugcheck or corrupts a function's return address, causing a crash when the function returns. No public evidence indicates a functional return-oriented-programming (ROP) chain or privilege escalation payload exists for this CVE at this time.

4. Post-exploitation impact: The immediate post-trigger effect is an availability loss — a blue screen, automatic reboot, or watchdog reset. A determined attacker can repeat the trigger to create a sustained denial of service against the target, preventing the host from maintaining stable wireless connectivity or completing normal operations. Because the described confidentiality and integrity impacts are "none," the likely attacker objective is disruption rather than data theft or system compromise. It should be noted that an unpatched Ring 0 memory-corruption bug carries inherent escalation risk over time, and the lack of a patch increases the probability that additional research will yield a code-execution primitive.

Impact Assessment

Business impact: This vulnerability directly threatens the availability of any Windows endpoint, laptop, or mobile workstation that uses an affected Intel Wi-Fi adapter and that can be reached from an adjacent wireless position. In practical terms, an attacker on the same wireless network — including a compromised guest device, a malicious client on a corporate SSID, or a parked-vehicle radio — can knock a target offline. Repeated triggering can cause crash loops, forcing manual recovery and creating significant operational disruption for field staff, remote workers, and wireless-dependent manufacturing or healthcare environments.

Blast radius: The vulnerable component is distributed with a broad consumer and enterprise product — Intel PROSet/Wireless WiFi Software for Windows — meaning the installed base is likely substantial. Because the attack vector is adjacent access rather than remote network access, the blast radius is limited to hosts physically within radio range of the attacker, but that constraint is weak in dense environments such as open-plan offices, conference centers, and public venues.

CVSS context: No official CVSS vector has been published (vector: N/A). The qualitative factors embedded in the NVD description align with a high-availability-impact, low-complexity, unauthenticated adjacent-vector profile; the absence of confidentiality and integrity impact keeps the overall severity moderate. EPSS score is 0.00174 (7.1st percentile of exploited CVEs), indicating the vulnerability is not currently a widespread exploitation target. CISA KEV does not list this CVE, and no known threat actor campaigns or exploits-in-the-wild have been reported. The dominant risk factor is the unpatched status: with patch confidence at 0/4, every affected system remains exposed, and exploitation likelihood will increase as reverse-engineering research matures.

Detection Guidance

There is no public signature, IoC, or exploit artifact for CVE-2026-24911. Detection must therefore be anomaly-based, focusing on (a) unexpected kernel bugchecks/crashes on hosts running Intel wireless software, (b) malformed or oversized wireless frames in monitor-mode captures, and (c) correlation between radio-layer anomalies and host crashes. The rules below are heuristic detections and should be validated against baseline network and endpoint behavior.

Sigma Rule

title: Intel PROSet Wireless WiFi - Kernel BugCheck / Unexpected Shutdown
id: 7c3e8f2a-9b41-4d62-8c33-1f9b0c4a6e77
status: experimental
description: >
  Detects unexpected shutdown or BugCheck events on Windows hosts,
  potentially indicating kernel-mode denial of service via CVE-2026-24911
  (Intel PROSet/Wireless WiFi stack-based buffer overflow).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-24911
author: Valters IT Threat Intelligence
date: 2026/05/15
logsource:
  product: windows
  service: system
detection:
  selection_bugcheck:
    EventID:
      - 1001                 # Windows Error Reporting BugCheck
      - 6008                 # Unexpected shutdown
    Provider_Name:
      - 'Microsoft-Windows-WER-SystemErrorReporting'
      - 'EventLog'
  selection_power:
    EventID: 41
    Provider_Name: 'Microsoft-Windows-Kernel-Power'
  filter_expected_maintenance:
    EventID: 6008
    Message|contains: 'maintenance'
  condition: (selection_bugcheck or selection_power) and not filter_expected_maintenance
  timeframe: 10m
level: high
falsepositives:
  - Hardware failures and power loss unrelated to wireless
  - Planned maintenance reboots
  - Other kernel driver defects
fields:
  - host.name
  - Message

YARA Rule

rule cve_2026_24911_intel_proset_wifi_dos
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects artifacts referencing CVE-2026-24911 and Intel PROSet/Wireless WiFi kernel denial of service research or exploit tooling"
        date = "2026-05-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-24911"
        cve = "CVE-2026-24911"
    strings:
        $cve = "CVE-2026-24911" ascii
        $prod = "PROSet/Wireless" ascii nocase
        $ring = "Ring 0" ascii nocase
        $buf  = "stack-based buffer overflow" ascii nocase
        $bug  = "BugCheck" ascii nocase
        $crash = "denial of service" ascii nocase
    condition:
        $cve and 2 of ($prod, $ring, $buf, $bug, $crash)
}

Suricata IDS Rule

# Requires 802.11 monitor-mode capture or a wireless tap/mirror.
# Detects sustained transmission of oversized or malformed WiFi management
# frames from a single source, a possible trigger pattern for CVE-2026-24911.
alert wlan any any -> any any (msg:"ET CVE-2026-24911 Potential Intel PROSet WiFi Kernel Overflow Trigger (Large Management Frame)"; wlan.fc.type:0; dsize:>2300; flowint:stat,overflow_count,+,1; flowint:stats,overflow_count,>10; classtype:attempted-dos; reference:cve,2026-24911; sid:3024911; rev:1;)

Elastic Detection

// Correlates Kernel-Power and BugCheck events on the same host within 10 minutes.
// A sudden sequence of such events may indicate a kernel-mode denial-of-service
// trigger such as CVE-2026-24911, particularly hosts with Intel wireless adapters.
sequence by host.name with maxspan=10m
  [ any where event.code == "41" and winlog.provider_name == "Microsoft-Windows-Kernel-Power" ]
  [ any where event.code == "1001" and winlog.provider_name == "Microsoft-Windows-WER-SystemErrorReporting" ]

Splunk SPL Query

(index=windows EventCode=6008) OR
(index=windows EventCode=1001 SourceName="Microsoft-Windows-WER-SystemErrorReporting") OR
(index=windows EventCode=41 SourceName="Microsoft-Windows-Kernel-Power")
| eval crash_time=_time
| stats count as crash_count, values(Message) as messages by host, date
| where crash_count >= 2
| join host [ search index=windows "Intel" AND "PROSet" earliest=-30d
    | stats count as wireless_evidence_count by host ]
| sort - crash_count
| table host, crash_count, messages

Wazuh OSSEC Rule

<group name="windows,system_events,attack.dos,">
  <!-- CVE-2026-24911 heuristic: unexpected shutdown / BugCheck events -->
  <rule id="310249" level="12">
    <if_sid>18103</if_sid>
    <field name="win.system.eventID">^1001$</field>
    <field name="win.system.providerName">Microsoft-Windows-WER-SystemErrorReporting</field>
    <description>Windows BugCheck reported - possible kernel DoS (CVE-2026-24911 Intel PROSet/Wireless WiFi)</description>
    <group>attack.dos,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="310250" level="10">
    <if_sid>18103</if_sid>
    <field name="win.system.eventID">^6008$</field>
    <description>Unexpected system shutdown - potential adjacent-access DoS activity (CVE-2026-24911)</description>
    <group>attack.dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch status: UNPATCHED. Patch confidence is 0/4 — no tracked source has produced a vendor fix, updated driver, or advisory containing a remediation version. Affected versions have not been publicly enumerated, so version-based remediation is currently impossible.

1. Immediate mitigations:

• Treat the wireless link as hostile. Disable the Intel WiFi adapter when it is not required (e.g., on wired-connected workstations) to eliminate the attack surface.
• In sites with sensitive operations, prefer wired Ethernet or external, non-Intel wireless adapters until Intel releases a fixed driver.
• Segment wireless networks: place clients on isolated SSIDs/VLANs and strictly enforce 802.1X authentication to minimize the ability of an adjacent attacker to associate with the same network.
• Deploy wireless intrusion prevention/monitoring (WIPS/WIDS) with monitor-mode sensors to detect malformed or oversized management frames.
• Enable Windows crash dump collection and forward System event logs (Event IDs 41, 1001, 6008) to the SIEM/SOC for anomaly detection.

2. Patch / upgrade steps:

• Subscribe to the Intel Security Center advisory feed (https://www.intel.com/content/www/us/en/security-center/default.html) and Intel PROSet/Wireless Software release notes.
• When a fixed version is published, deploy via the enterprise software update process (Windows Update Catalog, SCCM/Intune, or vendor-supplied driver package) as a priority change.
• Until then, do not apply unofficial "fixes" or third-party driver kexts; no legitimate patch exists, and unsourced binaries increase supply-chain risk.

3. Long-term hardening:

• Maintain an inventory of hardware models and wireless driver versions to expedite patching once the vendor releases a fixed build.
• Enable and test kernel crash dump analysis workflows so that post-incident triage can distinguish this CVE from other driver faults.
• Keep Endpoint Detection and Response (EDR) agents enabled on wireless hosts and tune the detection rules above to the local environment baseline.
• Monitor CISA KEV and FIRST EPSS for changes; an EPSS or KEV addition would signal active exploitation and justify emergency mitigation actions.
• Where possible, reduce reliance on vendor device drivers exposed to adjacent traffic by adopting hardware/firmware with stricter input validation and by keeping Windows kernel mitigations (HVCI/Memory Integrity, driver blocklist) enabled.

References

1. NVD Entry — CVE-2026-24911: https://nvd.nist.gov/vuln/detail/CVE-2026-24911
2. CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
3. Intel Security Center (vendor advisory index — no advisory published yet for this CVE): https://www.intel.com/content/www/us/en/security-center/default.html
4. FIRST EPSS — CVE-2026-24911 score lookup: https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaign / exploitation-in-the-wild evidence: none identified. CISA KEV does not include this CVE, no public exploit code or Nuclei template exists, and no vendor or researcher has documented active exploitation at the time of writing.