CVE-2026-20787: Intel WiFi Software DoS Vulnerability

CVE-2026-20787 Overview

CVE-2026-20787 is a null pointer dereference vulnerability [CWE-476] in Intel(R) PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 2: Device Drivers and can be triggered by an unauthenticated adjacent-network attacker. Successful exploitation causes a denial-of-service condition on the affected host by crashing the wireless driver.

The vulnerability requires no user interaction and no special internal knowledge of the target. It impacts availability only, with no direct impact to confidentiality or integrity of data handled by the driver.

Critical Impact
An adjacent unauthenticated attacker can cause a denial of service on Windows systems running vulnerable Intel PROSet/Wireless WiFi drivers by triggering a null pointer dereference in Ring 2 driver code.

Affected Products

Intel(R) PROSet/Wireless WiFi Software for Windows
Ring 2: Device Drivers component
Refer to Intel Security Advisory SA-01422 for the complete list of affected driver versions

Discovery Timeline

2026-08-11 - CVE-2026-20787 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20787

Vulnerability Analysis

The vulnerability is a null pointer dereference within the Intel PROSet/Wireless WiFi driver stack for Windows. When the driver processes specific wireless frames or control input from an adjacent network, a code path fails to validate a pointer before dereferencing it. Dereferencing the null pointer within kernel-adjacent driver code (Ring 2) causes the driver to fault, resulting in a denial-of-service condition on the host.

The attack is unauthenticated and low complexity. According to the advisory metadata, exploitation produces high availability impact on the vulnerable system and low subsequent availability impact on connected systems. Confidentiality and integrity are not affected. The EPSS probability of exploitation is 0.172%.

Root Cause

The root cause is missing validation of a pointer value before it is used inside the driver. When the driver receives malformed or unexpected wireless input, an internal allocation or lookup returns a null value that is subsequently dereferenced. This class of defect is tracked as CWE-476: NULL Pointer Dereference.

Attack Vector

The attack vector is adjacent network (AV:A), meaning the attacker must be within wireless range of the target or otherwise share the same broadcast/collision domain. No credentials are required, no user interaction is needed, and no elevated privileges are required. An attacker can transmit crafted wireless traffic that reaches the vulnerable driver code path and triggers the null dereference, crashing the driver and disrupting connectivity or the host itself.

No public proof-of-concept exploit is currently available. Refer to the Intel Security Advisory SA-01422 for vendor technical details.

Detection Methods for CVE-2026-20787

Indicators of Compromise

Unexpected crashes or bugchecks referencing the Intel PROSet/Wireless WiFi driver in Windows Event Log or WER reports
Repeated wireless adapter resets or disconnects on hosts within the same wireless range
Kernel minidumps identifying the Intel wireless driver module in the faulting stack

Detection Strategies

Monitor Windows System event logs for driver fault events (Event IDs 41, 1001) that name the Intel WiFi driver binary
Correlate wireless adapter reset events across multiple hosts in the same physical area, which may indicate active exploitation attempts
Track installed Intel PROSet/Wireless WiFi driver versions against the fixed versions listed in Intel SA-01422

Monitoring Recommendations

Inventory endpoints running Intel wireless drivers and flag any that do not match Intel's remediated version list
Alert on repeated BugCheck events on laptops and endpoints associated with the wireless driver module
Ingest endpoint crash telemetry into a centralized data lake to correlate driver crashes with nearby wireless activity

How to Mitigate CVE-2026-20787

Immediate Actions Required

Identify all Windows systems running Intel PROSet/Wireless WiFi Software and inventory installed driver versions
Apply the updated Intel PROSet/Wireless WiFi driver as specified in Intel Security Advisory SA-01422
Prioritize patching for mobile and field devices that connect to untrusted wireless networks

Patch Information

Intel has published remediation guidance and fixed driver versions in Intel Security Advisory SA-01422. Administrators should deploy the updated driver package through Windows Update, Intel Driver & Support Assistant, or their standard software distribution tooling. Verify the installed driver version after deployment.

Workarounds

Disable the Intel wireless adapter on systems that do not require wireless connectivity until the patch is applied
Restrict use of untrusted or public wireless networks on unpatched laptops
Where feasible, use wired Ethernet connectivity on affected hosts pending driver updates

bash

# Query installed Intel wireless driver version on Windows (PowerShell)
Get-PnpDeviceProperty -InstanceId (Get-PnpDevice -Class Net |
  Where-Object { $_.FriendlyName -like '*Intel*Wireless*' }).InstanceId `
  -KeyName 'DEVPKEY_Device_DriverVersion'