CVE-2026-20886: Intel PROSet/Wireless WiFi DoS Vulnerability

CVE-2026-20886 Overview

CVE-2026-20886 is an out-of-bounds write vulnerability [CWE-787] affecting some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers. An unauthenticated network adversary within adjacent network range can trigger the flaw to cause a denial of service on the affected host. Successful exploitation requires passive user interaction but no special internal knowledge of the target.

The vulnerability impacts availability of the host, with no confidentiality or integrity impact. Subsequent system availability may also be affected at a low level. Intel published details in advisory SA-01422.

Critical Impact
Adjacent-network attackers can crash the wireless driver stack on affected Windows systems running vulnerable Intel PROSet/Wireless WiFi Software, disrupting connectivity and host availability.

Affected Products

Intel(R) PROSet/Wireless WiFi Software for Windows
Intel Wireless device drivers operating in Ring 2
Refer to Intel Security Advisory SA-01422 for the full list of affected versions

Discovery Timeline

2026-08-11 - CVE-2026-20886 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-20886

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Intel PROSet/Wireless WiFi Software device driver code path executing within Ring 2. When the driver processes certain wireless frames or control input, it writes data past the bounds of an allocated buffer. The write corrupts adjacent kernel or driver memory structures, causing the driver or operating system to fault.

Because the driver operates in a privileged execution context, memory corruption leads to a system stop condition rather than an isolated user-mode crash. The attacker does not gain code execution or data disclosure. The end result is a denial of service against the affected host and its wireless connectivity.

Root Cause

The root cause is missing or incorrect bounds validation when the driver copies attacker-influenced data into a fixed-size buffer. Malformed wireless protocol input reaches the vulnerable write operation without sufficient length checks, permitting a write beyond the buffer boundary.

Attack Vector

The attack vector is adjacent network (AV:A), meaning the attacker must be within radio range of the target's wireless interface. No authentication is required, and attack complexity is low. Passive user interaction is required, such as the victim's system being associated with or scanning a wireless network. Refer to Intel Security Advisory SA-01422 for technical details.

Detection Methods for CVE-2026-20886

Indicators of Compromise

Unexpected Windows bug checks or system stop errors referencing Intel wireless driver modules such as Netwtw*.sys
Repeated wireless adapter resets, driver restarts, or loss of Wi-Fi connectivity on affected endpoints
Kernel-mode crash dumps that fault within Intel PROSet/Wireless driver call stacks
Anomalous or malformed 802.11 management frames observed on nearby wireless spectrum

Detection Strategies

Monitor Windows Event Log for BugCheck, Kernel-Power, and driver crash events correlated to Intel wireless components
Deploy endpoint telemetry to flag repeated driver crashes across a fleet, indicating possible active exploitation attempts
Inventory endpoint driver versions against the fixed versions listed in Intel advisory SA-01422

Monitoring Recommendations

Alert on clustered wireless driver faults across multiple endpoints in the same physical location
Track Wi-Fi disconnect and reassociation storms that coincide with unknown nearby SSIDs or rogue access points
Correlate crash dump signatures with the vulnerable Intel driver versions to identify unpatched systems

How to Mitigate CVE-2026-20886

Immediate Actions Required

Identify all Windows endpoints running Intel PROSet/Wireless WiFi Software and inventory installed driver versions
Apply the updated Intel PROSet/Wireless WiFi Software release referenced in Intel Security Advisory SA-01422
Prioritize patching for laptops and mobile endpoints that operate in untrusted wireless environments

Patch Information

Intel published fixed versions of the PROSet/Wireless WiFi Software in advisory SA-01422. Administrators should deploy the patched driver package through Windows Update, Intel Driver & Support Assistant, or OEM-provided driver update channels. Confirm the installed driver version matches or exceeds the fixed version stated in the advisory.

Workarounds

Disable the Wi-Fi adapter on systems that cannot be patched immediately and rely on wired connectivity
Restrict wireless association to trusted enterprise SSIDs using group policy or MDM controls
Operate affected devices outside untrusted wireless environments until patched driver deployment completes

bash

# Query installed Intel wireless driver version on Windows
pnputil /enum-drivers | findstr /I "Netwtw Intel Wireless"

# Disable wireless adapter as a temporary workaround (run elevated)
netsh interface set interface name="Wi-Fi" admin=disabled