CVE-2026-20747: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20747 Overview

CVE-2026-20747 is a denial-of-service vulnerability in certain Intel(R) PROSet/Wireless WiFi Software device drivers operating within Ring 2. The flaw stems from an improper conditions check [CWE-754] in kernel-mode wireless driver code. An unauthenticated adversary on an adjacent network can trigger the condition without user interaction, causing the affected system to become unavailable. The vulnerability affects only availability; confidentiality and integrity are not impacted.

Critical Impact
An unauthenticated attacker within wireless range can send crafted traffic that triggers a driver-level fault, resulting in a denial-of-service condition on systems running vulnerable Intel PROSet/Wireless WiFi drivers.

Affected Products

Intel(R) PROSet/Wireless WiFi Software (device driver components)
Systems using affected Intel wireless network adapters with vulnerable driver versions
Refer to the Intel Security Advisory INTEL-SA-01422 for the authoritative list of affected driver versions

Discovery Timeline

2026-08-11 - CVE-2026-20747 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20747

Vulnerability Analysis

The vulnerability resides in the Ring 2 device driver layer of Intel PROSet/Wireless WiFi Software. Ring 2 code executes with elevated kernel-adjacent privileges, so a fault in this component can destabilize the entire operating system. The driver fails to properly check a runtime condition, mapped to CWE-754 (Improper Check for Unusual or Exceptional Conditions).

When the driver processes wireless frames or management traffic containing an unexpected state, the missing condition check leads the driver into an unhandled path. This produces a crash or hang, taking down network connectivity and potentially the host itself.

Root Cause

The root cause is an improper conditions check within wireless driver processing logic. The driver does not validate a specific runtime state before continuing execution. When that state deviates from what the driver assumes, control flow proceeds into an unsafe branch that the driver cannot recover from.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within wireless range of the target. No authentication is required and no user interaction is needed. The attacker transmits crafted wireless traffic that the vulnerable driver processes, triggering the fault. Consult the Intel Security Advisory for technical specifics on triggering conditions and impacted code paths.

Detection Methods for CVE-2026-20747

Indicators of Compromise

Unexpected wireless driver crashes, bugchecks, or blue screen events referencing Intel PROSet/Wireless components
Repeated wireless adapter reset events in Windows Event Log around the time of connectivity loss
Sudden loss of wireless connectivity across multiple hosts within the same physical area

Detection Strategies

Inventory endpoints for Intel PROSet/Wireless WiFi Software versions and cross-reference against fixed versions listed in INTEL-SA-01422
Monitor kernel crash telemetry for faults originating from Intel wireless driver modules
Correlate wireless disconnection events with the presence of unknown or unauthorized transmitters in physical proximity

Monitoring Recommendations

Collect Windows kernel dump and Event Log data centrally for analysis of driver-level faults
Track wireless environment anomalies through enterprise WiFi infrastructure logs, including rogue AP and unusual frame reports
Alert on repeated netwtw*.sys or related Intel wireless driver crashes across the fleet

How to Mitigate CVE-2026-20747

Immediate Actions Required

Apply the driver updates published in Intel Security Advisory INTEL-SA-01422 to all systems running affected Intel PROSet/Wireless WiFi Software
Prioritize patching for mobile and executive endpoints that frequently operate on untrusted wireless networks
Validate driver versions after deployment through endpoint management tooling

Patch Information

Intel has published fixed driver versions through the INTEL-SA-01422 advisory. Administrators should obtain updates through Intel's Driver & Support Assistant, the OEM update channel for the affected hardware, or Windows Update where the OEM distributes drivers via that channel. Refer to the Intel Security Advisory for the exact fixed version numbers per adapter family.

Workarounds

Disable wireless adapters on systems that do not require WiFi connectivity until patched
Restrict use of untrusted or public wireless networks on affected endpoints
Prefer wired network connectivity for high-value systems in shared physical environments until driver updates are applied

bash

# Windows: query installed Intel wireless driver version
pnputil /enum-drivers | findstr /i "netwtw Intel"

# Windows: temporarily disable the wireless adapter as a workaround
netsh interface set interface name="Wi-Fi" admin=disabled