CVE-2025-35967 Overview
CVE-2025-35967 is an out-of-bounds read vulnerability [CWE-125] affecting Intel PROSet/Wireless WiFi Software for Windows before version 23.160. The flaw resides in Ring 2 device drivers and can be triggered by an unauthenticated adversary over an adjacent network. Successful exploitation results in a denial of service condition on the affected host.
Intel disclosed the issue in Intel Security Advisory SA-01398. The vulnerability requires no user interaction and no privileges, but the attacker must be on the same logical or physical network segment as the target.
Critical Impact
An unauthenticated adjacent-network attacker can crash or hang Windows systems running vulnerable Intel WiFi drivers, disrupting connectivity and availability.
Affected Products
- Intel PROSet/Wireless WiFi Software for Windows versions prior to 23.160
- Intel wireless device drivers operating at Ring 2 on Windows endpoints
- Windows systems shipping Intel WiFi components in OEM driver bundles
Discovery Timeline
- 2025-11-11 - CVE-2025-35967 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-35967
Vulnerability Analysis
The vulnerability is an out-of-bounds read within Intel PROSet/Wireless WiFi Software device driver code. The driver reads memory beyond the bounds of an allocated buffer when processing certain inputs. Because the affected component operates as a kernel-mode driver on Windows, the resulting fault propagates into the operating system rather than being contained to a user-space process.
The out-of-bounds read leads to availability impact only. Confidentiality and integrity are not affected according to the published advisory. The attack is exploitable from an adjacent network, meaning the adversary must reach the target over Wi-Fi or another link-local network rather than across routed internet paths.
No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability remains low at the time of writing.
Root Cause
The underlying defect is a missing or insufficient bounds check during the parsing of incoming wireless frames or driver IOCTL data. The driver dereferences memory past the end of a structure, causing the kernel to access invalid pages and trigger a bug check. CWE-125 describes this class of defect, where read operations exceed the intended buffer boundary.
Attack Vector
An attacker positioned on an adjacent network transmits crafted wireless traffic that the Intel driver parses without correctly validating length fields. Processing the malformed input causes the driver to read beyond allocated memory, which produces a denial of service. No authentication is required, no user interaction is needed, and the attack complexity is low. See the Intel Security Advisory SA-01398 for component-level details.
Detection Methods for CVE-2025-35967
Indicators of Compromise
- Repeated Windows bug checks or blue screen events referencing Intel wireless driver modules such as Netwtw*.sys
- Unexpected loss of WiFi connectivity coinciding with kernel crash dumps on endpoints in proximity to untrusted wireless networks
- Driver crash entries in the Windows Event Log with source Microsoft-Windows-WLAN-AutoConfig or related WiFi components
Detection Strategies
- Inventory endpoints running Intel PROSet/Wireless WiFi Software and flag versions earlier than 23.160
- Correlate WiFi driver crash telemetry with proximity-based events such as repeated association attempts from unknown SSIDs or BSSIDs
- Monitor EDR telemetry for unexpected restarts of wlansvc or kernel faults attributed to Intel wireless drivers
Monitoring Recommendations
- Forward Windows kernel crash dumps and WHEA events into a centralized log platform for analysis
- Alert on clusters of WiFi disconnects across multiple endpoints in the same physical location, which may indicate adjacent-network exploitation
- Track driver and software version compliance using endpoint management tooling to confirm the patch is deployed
How to Mitigate CVE-2025-35967
Immediate Actions Required
- Update Intel PROSet/Wireless WiFi Software to version 23.160 or later on all affected Windows endpoints
- Distribute the patched driver through OEM update channels or Intel Driver and Support Assistant for managed fleets
- Prioritize remediation for mobile endpoints and any systems used in untrusted wireless environments
Patch Information
Intel addressed the vulnerability in Intel PROSet/Wireless WiFi Software version 23.160. Refer to Intel Security Advisory SA-01398 for the authoritative list of fixed components and download links. OEM vendors typically redistribute Intel wireless drivers, so verify the vendor-specific package version matches or exceeds Intel's fixed release.
Workarounds
- Disable the Intel wireless adapter on systems that do not require WiFi until the driver update is applied
- Restrict endpoint usage to trusted wireless networks with WPA2/WPA3 enterprise authentication to reduce adjacent-network exposure
- Where feasible, use wired Ethernet for sensitive workstations until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
