CVE-2026-22887: Intel PROSet/Wireless WiFi DOS Vulnerability

CVE-2026-22887 Overview

CVE-2026-22887 is a kernel-mode denial-of-service vulnerability in Intel PROSet/Wireless WiFi Software for Windows. The flaw stems from improper buffer restrictions within Ring 0 kernel code [CWE-119]. An unauthenticated adversary on an adjacent network can trigger the condition without user interaction. Successful exploitation causes high availability impact on the affected system and can degrade dependent components.

Intel published details in Security Advisory SA-01468. The vulnerability carries a CVSS 4.0 base score of 8.3 and is tracked under the Adjacent Network attack vector. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
Unauthenticated adjacent-network attackers can crash the Windows kernel via improper buffer handling in Intel PROSet/Wireless WiFi drivers, producing a denial-of-service condition on affected endpoints.

Affected Products

Intel PROSet/Wireless WiFi Software for Windows (specific versions listed in Intel SA-01468)
Windows endpoints shipping Intel wireless kernel drivers
Systems within wireless range of an attacker (Adjacent Network scope)

Discovery Timeline

2026-08-11 - CVE-2026-22887 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-22887

Vulnerability Analysis

The vulnerability resides in the Ring 0 kernel component of Intel PROSet/Wireless WiFi Software for Windows. Improper buffer restrictions [CWE-119] allow operations on memory buffers to exceed their intended boundaries. Because the affected code executes at kernel privilege, memory corruption or invalid access produces a bugcheck rather than a user-mode crash.

The result is a denial-of-service condition affecting the host system. The advisory characterizes integrity impact as low and availability impact as high, with no confidentiality loss. Subsequent system availability is also impacted, meaning downstream components dependent on the wireless stack become unusable until the host restarts.

Root Cause

The root cause is insufficient validation of buffer boundaries when the kernel driver processes wireless data. When input exceeds the allocated buffer or crosses expected boundary conditions, the driver performs improper memory operations. Intel has not published low-level technical details beyond the advisory summary in SA-01468.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must be within wireless range of the target. No authentication is required and no user interaction is needed. An unprivileged remote actor can send crafted wireless frames that the vulnerable driver parses within kernel context. The low attack complexity indicates no specialized preconditions beyond proximity and the ability to transmit frames the driver will process.

No public proof-of-concept code has been released. Refer to the Intel Security Advisory SA-01468 for vendor-supplied technical details.

Detection Methods for CVE-2026-22887

Indicators of Compromise

Unexpected Windows bugchecks (BSOD) with stop codes referencing Intel wireless drivers such as Netwtw*.sys or related PROSet kernel modules.
Repeated wireless adapter resets, disconnections, or driver-restart events on affected endpoints.
Concentration of driver-fault events across multiple hosts in the same physical vicinity, suggesting an adjacent attacker.

Detection Strategies

Correlate Windows Event Log entries (Microsoft-Windows-WLAN-AutoConfig, System log source BugCheck) with wireless driver crash signatures.
Monitor endpoint telemetry for kernel crash dumps whose faulting module maps to Intel PROSet/Wireless WiFi driver binaries.
Track Intel PROSet/Wireless WiFi Software versions across the fleet and flag hosts running versions listed as vulnerable in Intel SA-01468.

Monitoring Recommendations

Ingest Windows System and Application event logs into a central SIEM and alert on repeated bugchecks tied to Intel wireless drivers.
Baseline normal WiFi disconnect/reconnect rates per endpoint and alert on statistically anomalous spikes.
Monitor wireless environments in sensitive locations for rogue transmitters or unexpected 802.11 activity that could indicate an adjacent-network attacker.

How to Mitigate CVE-2026-22887

Immediate Actions Required

Identify all Windows endpoints running Intel PROSet/Wireless WiFi Software and inventory driver versions against Intel SA-01468.
Apply the updated Intel PROSet/Wireless WiFi driver package supplied by Intel or the system OEM as soon as it is available.
Prioritize patching of laptops and mobile devices operating in public or shared wireless environments where adjacent-network exposure is highest.

Patch Information

Intel has released fixed versions of the PROSet/Wireless WiFi Software as documented in Intel Security Advisory SA-01468. System OEMs (Dell, HP, Lenovo, and others) typically redistribute Intel wireless driver updates through their own support channels; administrators should apply the update via the OEM package where required for platform compatibility.

Workarounds

Disable the Intel wireless adapter on affected hosts and use wired Ethernet where feasible until the patch is deployed.
Restrict endpoint use to trusted wireless networks and avoid open or untrusted WiFi where adjacent attackers could reach the driver.
Enforce corporate wireless policies that limit connections to managed SSIDs with WPA3 or WPA2-Enterprise authentication.

bash

# Query installed Intel wireless driver version on Windows (PowerShell)
Get-WmiObject Win32_PnPSignedDriver |
  Where-Object { $_.DeviceName -like "*Intel*Wireless*" } |
  Select-Object DeviceName, DriverVersion, DriverDate

# Temporarily disable the wireless adapter until patched
Disable-NetAdapter -Name "Wi-Fi" -Confirm:$false