CVE-2026-20878: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20878 Overview

CVE-2026-20878 is a null pointer dereference vulnerability [CWE-476] in the Intel(R) PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 2: Device Drivers and can be triggered by an unauthenticated attacker over an adjacent network. Successful exploitation causes a denial of service (DoS) on the affected system. The vulnerability does not impact confidentiality or integrity but has a high availability impact on the vulnerable component. Intel disclosed the issue in Intel Security Advisory SA-01422.

Critical Impact
An adjacent, unauthenticated attacker can crash the Windows wireless driver, disrupting network connectivity and system availability without requiring user interaction.

Affected Products

Intel(R) PROSet/Wireless WiFi Software for Windows
Ring 2 Device Drivers shipped with the PROSet/Wireless WiFi package
Windows endpoints using Intel wireless adapters managed by the affected driver

Discovery Timeline

2026-08-11 - CVE-2026-20878 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20878

Vulnerability Analysis

The vulnerability is a null pointer dereference in the Intel PROSet/Wireless WiFi driver for Windows. The driver operates at Ring 2 (device driver privilege), meaning a crash affects kernel-adjacent networking components and disrupts host wireless operation. An attacker within radio range can transmit crafted wireless frames that reach the driver before authentication is required, triggering the flaw. The result is a driver fault that terminates wireless connectivity and can destabilize the host. Because the attack requires no user interaction and no privileges, the exploitation barrier is limited to physical proximity to the wireless interface. The EPSS score at publication was 0.219%.

Root Cause

The root cause is a code path in the wireless driver that dereferences a pointer without validating it against NULL. When the driver processes a specific type of unauthenticated wireless management or control frame, an internal object or field is not initialized as expected, and the subsequent access on that pointer faults. This class of defect [CWE-476] typically arises when error paths or optional protocol fields are not handled before pointer use.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within wireless range of the target adapter. The attacker does not need credentials or user interaction on the target. By sending malformed or unexpected 802.11 frames that reach the vulnerable parsing routine in the PROSet/Wireless driver, the attacker forces the driver into the null dereference state. The immediate outcome is a driver crash, loss of wireless connectivity, and potential system instability. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. Refer to Intel Security Advisory SA-01422 for vendor technical detail.

// No verified exploit code is publicly available for CVE-2026-20878.
// The vulnerability is triggered by crafted 802.11 frames that reach
// an unvalidated pointer in the Intel PROSet/Wireless WiFi driver.

Detection Methods for CVE-2026-20878

Indicators of Compromise

Unexpected Windows system events indicating a wireless driver fault, bug check, or repeated Netwtw*.sys module crashes.
Sudden, repeated loss of wireless connectivity on Intel-based endpoints without corresponding access point outages.
Elevated volume of malformed 802.11 management frames observed by nearby monitoring sensors.

Detection Strategies

Collect Windows Reliability Monitor and Event Log entries for driver crashes tied to Intel wireless kernel modules and correlate against endpoint telemetry.
Deploy wireless intrusion detection (WIDS) to flag anomalous or malformed 802.11 frames in areas with sensitive endpoints.
Track patch state of the Intel PROSet/Wireless WiFi Software across the fleet and alert on unpatched hosts.

Monitoring Recommendations

Baseline normal wireless driver stability and alert on statistically significant increases in driver reset or crash events.
Monitor endpoints for repeated WLAN AutoConfig service restarts, which can indicate driver recovery from a fault.
Aggregate driver fault telemetry into the SIEM to correlate localized DoS events with physical location and time.

How to Mitigate CVE-2026-20878

Immediate Actions Required

Inventory all Windows endpoints using Intel PROSet/Wireless WiFi Software and identify versions in scope of Intel Security Advisory SA-01422.
Apply the updated Intel PROSet/Wireless WiFi driver package provided by Intel or the system OEM as soon as it is available for the affected platform.
Prioritize patching for mobile users, executives, and staff who operate in high-density or untrusted wireless environments.

Patch Information

Intel has published remediation guidance in Intel Security Advisory SA-01422. Administrators should install the fixed version of the Intel PROSet/Wireless WiFi Software for Windows referenced in that advisory. On OEM-managed systems, obtain the corresponding driver update from the hardware vendor's support channel to ensure signed, platform-validated binaries.

Workarounds

Where patching is delayed, disable the Intel wireless adapter and use wired Ethernet on affected hosts operating in untrusted environments.
Restrict use of affected endpoints in public or high-risk wireless zones until the driver update is deployed.
Enforce use of enterprise-managed access points and monitor for rogue devices operating near sensitive endpoints.

bash

# Example: check installed Intel wireless driver version on Windows (PowerShell)
Get-PnpDevice -Class Net | Where-Object { $_.FriendlyName -like '*Intel*Wi-Fi*' } |
  ForEach-Object {
    Get-PnpDeviceProperty -InstanceId $_.InstanceId -KeyName 'DEVPKEY_Device_DriverVersion'
  }