CVE-2026-24911: Intel PROSet/Wireless WiFi DOS Vulnerability

CVE-2026-24911 Overview

CVE-2026-24911 is a stack-based buffer overflow [CWE-121] affecting Intel PROSet/Wireless WiFi Software for Windows. The flaw resides within Ring 0 kernel-mode code, where improper bounds handling on the stack can be triggered by an unauthenticated adversary. Successful exploitation results in a denial of service condition on the affected system. The vulnerability is reachable over an adjacent network, meaning the attacker must be within radio range or share the same logical network segment as the target. Confidentiality and integrity are not impacted, but availability impact is high.

Critical Impact
An unauthenticated attacker on an adjacent network can crash the Windows kernel through the vulnerable Intel WiFi driver, producing a system-wide denial of service without user interaction.

Affected Products

Intel PROSet/Wireless WiFi Software for Windows (specific versions listed in Intel Security Advisory SA-01468)
Windows endpoints running the affected Intel wireless driver in kernel mode (Ring 0)
Devices using Intel wireless adapters managed by the vulnerable driver stack

Discovery Timeline

2026-08-11 - CVE-2026-24911 published to the National Vulnerability Database
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-24911

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow located inside a kernel-mode component of Intel PROSet/Wireless WiFi Software for Windows. Because the vulnerable code executes in Ring 0, any corruption of the kernel stack propagates directly to the operating system's most privileged context. In this case, the corruption is used to force a denial of service rather than code execution, producing a bugcheck or driver crash that takes the host offline.

The attacker profile is significant. Exploitation does not require authentication, user interaction, or prior privileges on the target. An adversary within adjacent network range can send crafted wireless frames that reach the vulnerable driver processing path. Because the driver runs before higher-level Windows security boundaries can inspect the traffic, the malformed input is parsed in kernel context and triggers the overflow.

Availability impact extends beyond the initial process. A kernel driver failure in the wireless stack disrupts network connectivity, forces system restarts, and can be repeated as long as the attacker remains in radius of the target radio.

Root Cause

The root cause is improper validation of the length of data written to a stack-allocated buffer inside the Intel wireless driver. When input data exceeds the expected size, the driver writes past the buffer boundary and corrupts adjacent stack memory, including saved return addresses and control data used by the kernel. Refer to Intel Security Advisory SA-01468 for component-level details.

Attack Vector

The attack vector is Adjacent Network. An unauthenticated adversary within wireless range transmits malformed 802.11 frames or driver-specific control data that reach the vulnerable parsing routine. No user interaction is needed on the target. The vulnerable code path is exercised by the driver during normal frame handling, so a system with the affected driver loaded and the wireless radio active is exposed by default.

No public proof-of-concept exploit code is available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. The vulnerability is described in prose only; see the vendor advisory for technical specifics.

Detection Methods for CVE-2026-24911

Indicators of Compromise

Windows bugcheck events (BSOD) referencing Intel wireless driver modules such as Netwtw*.sys or related PROSet components
Repeated wireless adapter resets, driver restarts, or NDIS-related error events in the Windows event log
Sudden loss of wireless connectivity across multiple hosts in the same physical area, suggesting an adjacent-network trigger

Detection Strategies

Correlate kernel crash dumps with the loaded Intel wireless driver version to identify hosts running vulnerable builds
Monitor endpoint telemetry for unexpected WerFault.exe and kernel crash reports tied to wireless subsystems
Inventory hosts by installed Intel PROSet/Wireless WiFi Software version and flag those below the fixed release listed in Intel SA-01468

Monitoring Recommendations

Enable and forward Windows System event log entries (source Microsoft-Windows-WLAN-AutoConfig and Kernel-Power) to a central SIEM
Alert on clusters of wireless driver crashes across multiple endpoints in the same location within a short time window
Track wireless intrusion detection sensors for malformed 802.11 management or data frames targeting driver parsers

How to Mitigate CVE-2026-24911

Immediate Actions Required

Apply the updated Intel PROSet/Wireless WiFi Software release identified in Intel Security Advisory SA-01468 to all affected Windows endpoints
Prioritize patching for mobile and remote users who frequently operate on untrusted wireless networks
Audit endpoint inventory to confirm the deployed Intel wireless driver version matches the fixed build

Patch Information

Intel has published guidance in Security Advisory SA-01468 covering the affected Intel PROSet/Wireless WiFi Software for Windows and the fixed versions. Administrators should download the updated driver package from Intel's official distribution channels or apply the update through vendor OEM channels for laptops that ship customized Intel wireless drivers.

Workarounds

Disable the wireless radio on affected hosts when a wired connection is available and patching is delayed
Restrict use of affected devices to trusted wireless networks until the driver update is deployed
Where policy permits, uninstall or disable the Intel PROSet/Wireless driver and rely on the in-box Windows driver until the fixed version is validated for deployment

bash

# Query installed Intel wireless driver version on Windows to identify vulnerable hosts
Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.DeviceName -like "*Intel*Wireless*" } | Select-Object DeviceName, DriverVersion, DriverDate