CVE-2025-35971: Intel PROSet/Wireless WiFi DOS Vulnerability

CVE-2025-35971 Overview

CVE-2025-35971 is an out-of-bounds write vulnerability [CWE-787] in Intel PROSet/Wireless WiFi Software for Windows before version 23.160. The flaw resides in Ring 2 device drivers and can be triggered by an unauthenticated, unprivileged adversary over an adjacent network. Successful exploitation results in denial of service on the affected host. The vulnerability requires no user interaction and low attack complexity, making it reachable from any device within wireless range of the target.

Critical Impact
An unauthenticated attacker on an adjacent network can write outside allocated driver memory boundaries to crash the wireless driver and the host system, producing a high-availability impact without any user interaction.

Affected Products

Intel PROSet/Wireless WiFi Software for Windows before version 23.160
Intel wireless device drivers operating in Ring 2 shipped with affected PROSet packages
Windows endpoints using vulnerable Intel wireless driver builds

Discovery Timeline

2025-11-11 - CVE-2025-35971 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-35971

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] inside Intel PROSet/Wireless WiFi Software components that execute in Ring 2 driver context. The driver writes data past the bounds of a buffer when handling specific wireless input, corrupting adjacent memory in kernel-adjacent code paths. Because the write occurs in a driver, memory corruption translates directly into kernel-mode instability and system crash. The reported impact is denial of service with no confidentiality compromise, low integrity impact on the vulnerable component, and high availability impact on both the vulnerable component and the surrounding system.

Root Cause

The root cause is improper validation of input size or index values before writing into a fixed-length buffer within the wireless driver. The driver accepts data delivered over wireless protocols and processes it without enforcing boundary checks on the destination buffer. When attacker-supplied data exceeds the expected size, the write extends past the buffer, corrupting adjacent driver structures and triggering a kernel exception.

Attack Vector

The attack vector is adjacent network access, meaning the attacker must be within wireless range of the vulnerable host but does not need to be on the same logical network. No authentication or user interaction is required. An attacker sends crafted wireless frames that the Intel driver parses, triggering the out-of-bounds write and crashing the host. No public proof-of-concept exploit and no in-the-wild exploitation have been reported. The EPSS probability is 0.042%, reflecting low observed exploitation activity at this time.

No verified exploitation code is publicly available. Refer to Intel Security Advisory SA-01398 for vendor technical details.

Detection Methods for CVE-2025-35971

Indicators of Compromise

Unexpected bug checks or BSOD events referencing Intel wireless driver modules such as Netwtw*.sys
Repeated wireless adapter resets, driver reload events, or WHEA-Logger entries on systems with Intel PROSet/Wireless installed
Crash dump signatures showing access violations originating from Intel wireless driver call stacks

Detection Strategies

Inventory endpoints running Intel PROSet/Wireless WiFi Software and flag any installed version below 23.160
Correlate Windows Event Log entries for driver faults with the presence of vulnerable Intel wireless driver versions
Monitor for clustered wireless driver crashes across multiple hosts in the same physical area, which can indicate adjacent-network exploitation attempts

Monitoring Recommendations

Forward Windows kernel crash events and Microsoft-Windows-Kernel-PnP logs to a centralized log platform for correlation
Track wireless driver version compliance as a continuous configuration metric on managed Windows endpoints
Alert on anomalous 802.11 management or data frame patterns near sensitive sites where wireless monitoring is available

How to Mitigate CVE-2025-35971

Immediate Actions Required

Update Intel PROSet/Wireless WiFi Software to version 23.160 or later on all affected Windows endpoints
Prioritize patching for laptops and mobile devices that operate in untrusted physical environments
Validate driver versions after patching using endpoint management tooling to confirm remediation

Patch Information

Intel has released fixed PROSet/Wireless WiFi Software version 23.160 and later. Patch details and download links are available in the Intel Security Advisory SA-01398. Apply the vendor-supplied driver package through standard enterprise software distribution channels.

Workarounds

Disable the Intel wireless adapter on endpoints that cannot be patched immediately and rely on wired connectivity
Restrict use of vulnerable laptops in high-risk physical environments until the driver update is applied
Enforce wireless connection only to trusted, monitored networks to reduce exposure to adjacent attackers

bash

# Verify installed Intel PROSet/Wireless driver version on Windows
Get-NetAdapter | Where-Object { $_.InterfaceDescription -like "*Intel*Wireless*" } |
  Select-Object Name, InterfaceDescription, DriverVersion, DriverDate

# Disable the wireless adapter as a temporary workaround
Disable-NetAdapter -Name "Wi-Fi" -Confirm:$false