CVE-2026-20745: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20745 Overview

CVE-2026-20745 is an out-of-bounds write vulnerability [CWE-787] affecting Intel PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 2 device driver code and can be triggered by an unauthenticated network adversary. Exploitation requires adjacent network access and no user interaction. Successful attacks lead to a denial-of-service condition on the affected system.

The vulnerability primarily impacts system availability, with limited integrity impact and no confidentiality impact. Intel disclosed the issue in advisory SA-01422 and assigned it a HIGH severity rating.

Critical Impact
A wireless-range attacker can trigger an out-of-bounds write in the Wi-Fi driver, crashing the host and disrupting network connectivity without authentication or user interaction.

Affected Products

Intel PROSet/Wireless WiFi Software for Windows
Intel Wi-Fi device drivers operating within Ring 2 (kernel-mode driver context)
Refer to Intel Security Advisory SA-01422 for the full list of affected versions

Discovery Timeline

2026-08-11 - CVE-2026-20745 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20745

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Intel PROSet/Wireless WiFi Software driver stack for Windows. The affected code executes within Ring 2, a privileged driver context. An attacker on an adjacent wireless network can send crafted frames that cause the driver to write beyond an allocated buffer.

This memory corruption destabilizes the driver and, by extension, the operating system. The resulting condition manifests as a denial of service, typically a system crash or loss of wireless connectivity. Because the flaw lives in a kernel-adjacent driver, the impact extends beyond the wireless subsystem to overall host availability.

Intel documents low integrity impact alongside high availability impact, indicating that limited memory state changes may occur before the crash. There is no confidentiality impact on the vulnerable system itself.

Root Cause

The root cause is missing or insufficient bounds checking when the driver processes attacker-controlled wireless input. Data written past the intended buffer boundary corrupts adjacent kernel memory structures. This corruption forces the operating system to halt driver execution to maintain integrity.

Attack Vector

The attack vector is adjacent network access, meaning the attacker must be within wireless range of a vulnerable host. Attack complexity is low, no privileges are required, and no user interaction is needed. An attacker transmits crafted 802.11 frames or management traffic that the Intel Wi-Fi driver processes incorrectly, triggering the out-of-bounds write.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code has been published. Refer to the Intel Security Advisory SA-01422 for vendor technical details.

Detection Methods for CVE-2026-20745

Indicators of Compromise

Unexpected Windows bug checks or blue screen events referencing Intel Wi-Fi driver modules such as Netwtw*.sys
Repeated wireless adapter disconnects or driver restart events in the Windows System event log
Anomalous 802.11 management frames observed from unknown transmitters within wireless range

Detection Strategies

Inventory endpoints running Intel PROSet/Wireless WiFi Software and correlate installed driver versions against those listed in Intel advisory SA-01422
Alert on Windows Error Reporting events and kernel crash dumps that identify Intel wireless driver faults
Monitor wireless intrusion detection sensors for malformed or non-standard 802.11 frames targeting client devices

Monitoring Recommendations

Forward Windows kernel and driver crash telemetry to a centralized SIEM for correlation across the fleet
Track sudden clusters of Wi-Fi driver failures across multiple hosts in the same physical area, which may indicate active exploitation attempts
Baseline normal wireless client behavior so that repeated adapter resets stand out as investigable anomalies

How to Mitigate CVE-2026-20745

Immediate Actions Required

Apply the driver updates provided by Intel as documented in advisory SA-01422 to all Windows hosts running Intel PROSet/Wireless WiFi Software
Prioritize patching for mobile and laptop fleets that routinely connect to untrusted wireless environments
Verify driver versions after patch deployment using endpoint management tooling

Patch Information

Intel has released updated PROSet/Wireless WiFi Software and driver packages. Consult the Intel Security Advisory SA-01422 for fixed version numbers and download locations. Deploy the updates through standard OEM or Intel driver distribution channels.

Workarounds

Disable the Wi-Fi adapter on affected systems when operating in high-risk wireless environments until patches are applied
Restrict association to trusted enterprise SSIDs and disable auto-connect to open networks
Use wired network connectivity where feasible for systems that cannot be updated immediately

bash

# Example: Disable the Wi-Fi adapter on Windows via PowerShell until patched
Disable-NetAdapter -Name "Wi-Fi" -Confirm:$false

# Verify installed Intel wireless driver version
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*Intel*Wireless*" } | Select-Object DeviceName, DriverVersion, DriverDate