CVE-2026-20776: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20776 Overview

CVE-2026-20776 is a denial of service vulnerability affecting Intel(R) PROSet/Wireless WiFi Software device drivers operating in Ring 2. The flaw stems from an improper conditions check [CWE-754] inside the driver code path. An unauthenticated network adversary within adjacent network range can trigger the condition and disrupt system availability. Exploitation requires no user interaction and no special internal knowledge. The vulnerability impacts availability only, with no impact on confidentiality or integrity of the affected system.

Critical Impact
A remote, unauthenticated attacker on an adjacent wireless network can trigger a denial of service against systems running vulnerable Intel PROSet/Wireless WiFi drivers, disabling connectivity and impacting host availability.

Affected Products

Intel(R) PROSet/Wireless WiFi Software (specific versions listed in Intel Security Advisory SA-01422)
Intel wireless device drivers operating in Ring 2
Windows endpoints and laptops using affected Intel wireless adapters

Discovery Timeline

2026-08-11 - CVE-2026-20776 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20776

Vulnerability Analysis

The vulnerability resides in the Intel PROSet/Wireless WiFi Software device driver layer, which operates within Ring 2 privileges. An improper conditions check permits a malformed input or unexpected state to reach code paths that the driver does not correctly handle. When triggered, the driver enters a failure state that disrupts wireless subsystem operations on the host.

An attacker within wireless range of the target device can transmit crafted frames that reach the vulnerable driver code. Because the driver processes these frames without correctly validating preconditions, the system availability is impacted. The vulnerability does not disclose data and does not allow modification of host content.

The scope of impact extends beyond the immediate driver. According to the CVSS 4.0 vector, subsequent system availability is also affected, indicating that the driver failure can degrade or crash dependent components on the host.

Root Cause

The root cause is an improper check for unusual or exceptional conditions [CWE-754]. The driver assumes certain preconditions hold when processing wireless input, but fails to validate them before dispatching further logic. This gap allows adversary-controlled input to steer execution into an unrecoverable state.

Attack Vector

The attack vector is Adjacent Network. An adversary must be within radio range of the target wireless adapter but does not require credentials or user interaction. The attacker transmits crafted wireless traffic that reaches the driver processing path. No prior foothold, phishing lure, or authenticated session is needed to reach the vulnerable code.

The vulnerability does not permit code execution or data access. The result is limited to denial of service against the wireless subsystem and dependent host functions.

Refer to the Intel Security Advisory SA-01422 for technical details from the vendor.

Detection Methods for CVE-2026-20776

Indicators of Compromise

Repeated wireless driver crashes, resets, or Wlansvc service restarts on Intel wireless adapters
Windows Event Log entries indicating Intel wireless driver faults or bugchecks referencing the wireless miniport driver
Unexpected loss of wireless connectivity across multiple hosts in the same physical area
Abnormal or malformed 802.11 management or control frames captured near affected endpoints

Detection Strategies

Monitor host telemetry for driver fault events tied to Intel PROSet/Wireless drivers and correlate across nearby endpoints
Inventory installed Intel PROSet/Wireless WiFi Software versions and compare against the fixed versions in Intel SA-01422
Use wireless intrusion detection to flag anomalous 802.11 frame patterns targeting affected clients

Monitoring Recommendations

Alert on clusters of wireless disconnects or driver crashes co-located in time and physical proximity
Track patch compliance for Intel wireless driver versions across the endpoint fleet
Capture kernel crash dumps referencing Intel wireless driver modules for post-incident analysis

How to Mitigate CVE-2026-20776

Immediate Actions Required

Identify all endpoints running Intel PROSet/Wireless WiFi Software and confirm driver versions against Intel SA-01422
Deploy the updated Intel wireless driver package provided by Intel or the system OEM to all affected hosts
Prioritize patching for mobile and executive endpoints that operate in shared or public wireless environments

Patch Information

Intel has published remediation guidance and updated driver versions in Intel Security Advisory SA-01422. Administrators should obtain the fixed driver from Intel or from the OEM software update channel for the affected device model. Enterprise deployment tools such as Microsoft Intune, WSUS, or SCCM can distribute the updated driver package.

Workarounds

Disable the Intel wireless adapter on high-risk hosts until patched, using wired connectivity where available
Restrict operation of affected devices to trusted wireless environments while patching is in progress
Enforce use of enterprise wireless networks with monitoring, avoiding unmanaged public Wi-Fi

bash

# Query installed Intel wireless driver version on Windows
pnputil /enum-drivers | findstr /I "Intel"

# Disable the wireless adapter as a temporary workaround
netsh interface set interface name="Wi-Fi" admin=disabled