CVE-2026-20795: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20795 Overview

CVE-2026-20795 is a denial-of-service vulnerability in Intel(R) PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 2 device drivers and stems from improper buffer restrictions [CWE-119]. An unauthenticated network adversary on an adjacent network can trigger the condition without user interaction. Successful exploitation impacts availability of the vulnerable system while leaving confidentiality and integrity untouched. Intel disclosed the issue in Intel Security Advisory SA-01422.

Critical Impact
A wireless-range attacker can crash or destabilize systems running affected Intel PROSet/Wireless WiFi drivers without authentication or user interaction, producing high availability impact on the target host.

Affected Products

Intel(R) PROSet/Wireless WiFi Software for Windows
Ring 2 device driver components shipped by Intel
Windows endpoints using affected Intel wireless adapter drivers

Discovery Timeline

2026-08-11 - CVE-2026-20795 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20795

Vulnerability Analysis

The vulnerability is a buffer boundary flaw [CWE-119] inside Intel PROSet/Wireless WiFi driver code executing at Ring 2. The driver fails to properly restrict operations on a memory buffer, allowing malformed inputs delivered over the wireless medium to trigger a fault condition. Because the flawed code path runs within a device driver, the resulting fault destabilizes the wireless stack or the host operating system. The attacker does not need credentials, prior knowledge of the target, or user interaction. Successful exploitation only affects availability, with no confidentiality or integrity loss reported by Intel.

Root Cause

The root cause is improper enforcement of buffer size or offset checks within the wireless driver's Ring 2 code. When the driver processes attacker-controlled wireless frames or management data, the missing validation allows access outside the intended buffer bounds. This produces memory corruption sufficient to crash the driver or the kernel context that hosts it.

Attack Vector

The attack vector is adjacent network access, meaning the adversary must be within wireless range of the target. The attacker transmits crafted wireless traffic that reaches the vulnerable driver's parsing routines. Attack complexity is low and no authentication or user interaction is required. There are no known public exploits or CISA KEV listings for CVE-2026-20795 at time of publication. The EPSS score is 0.172%.

No verified proof-of-concept code is publicly available. Refer to Intel Security Advisory SA-01422 for technical details.

Detection Methods for CVE-2026-20795

Indicators of Compromise

Repeated crashes, bugchecks, or blue screen events referencing Intel PROSet/Wireless driver modules
Unexpected wireless adapter resets, disconnections, or driver restart events in Windows Event Log
Anomalous 802.11 management or data frames from unknown sources in wireless IDS logs
Sudden loss of connectivity across multiple hosts using the same Intel wireless chipset in a shared RF area

Detection Strategies

Monitor Windows kernel and driver crash telemetry for faults attributed to Intel PROSet/Wireless components
Correlate wireless adapter reset events with proximity-based wireless activity captured by WIDS sensors
Baseline driver version inventory across the fleet and flag hosts still running vulnerable versions listed in Intel SA-01422

Monitoring Recommendations

Enable and centralize collection of Microsoft-Windows-WLAN-AutoConfig and System event logs
Track bugcheck codes and minidumps referencing wireless driver binaries via endpoint telemetry
Alert on clustered driver crashes across multiple endpoints in the same physical location, which may indicate RF-based exploitation attempts

How to Mitigate CVE-2026-20795

Immediate Actions Required

Inventory all Windows systems running Intel PROSet/Wireless WiFi Software and identify affected driver versions
Apply the driver update referenced in Intel Security Advisory SA-01422 as soon as vendor packages are validated
Prioritize patching for mobile and executive systems that frequently operate in untrusted wireless environments

Patch Information

Intel has published mitigation guidance in Intel Security Advisory SA-01422. Administrators should obtain the updated PROSet/Wireless driver package from Intel or the OEM system vendor and deploy it through standard patch management workflows. Verify the installed driver version after deployment to confirm remediation.

Workarounds

Disable the wireless adapter on systems that do not require WiFi connectivity until patched
Restrict operation of vulnerable devices to controlled wireless environments where rogue transmitters are unlikely
Enforce use of wired connections for high-value endpoints pending driver updates

bash

# Query installed Intel wireless driver version on Windows (PowerShell)
Get-PnpDevice -Class Net | Where-Object { $_.FriendlyName -match 'Intel.*Wireless' } |
  ForEach-Object { Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName 'DEVPKEY_Device_DriverVersion' }

# Temporarily disable the wireless adapter until patched
Disable-NetAdapter -Name 'Wi-Fi' -Confirm:$false