CVE-2026-32161: Windows 10 1607 Race Condition Vulnerability

CVE-2026-32161 Overview

CVE-2026-32161 is a race condition vulnerability in the Windows Native WiFi Miniport Driver. The flaw stems from concurrent execution using a shared resource without proper synchronization [CWE-362]. An unauthenticated attacker within wireless range can exploit the race condition to execute arbitrary code on the target system. The vulnerability affects a broad set of Microsoft Windows client and server releases, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Microsoft published the advisory on May 12, 2026, with the entry last modified on May 14, 2026.

Critical Impact

Successful exploitation grants remote code execution at driver privilege level over an adjacent wireless network, with no authentication or user interaction required.

Affected Products

• Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64 architectures
• Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64 architectures
• Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

• 2026-05-12 - CVE-2026-32161 published to NVD
• 2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-32161

Vulnerability Analysis

The Windows Native WiFi Miniport Driver (nwifi.sys) manages low-level 802.11 frame processing between the wireless network adapter and the NDIS subsystem. The driver handles concurrent operations on shared data structures while servicing frame receive callbacks, association state changes, and ioctl requests from user mode. A synchronization gap allows two threads to access the same resource without coordination, producing an exploitable state. An adjacent attacker who transmits crafted wireless frames at the right moment can trigger the race window and corrupt driver state. Successful exploitation results in arbitrary code execution within the kernel driver context. The high attack complexity reflects the timing precision required to win the race reliably.

Root Cause

The root cause is improper synchronization on a shared resource accessed by concurrent execution paths inside the Native WiFi Miniport Driver. CWE-362 classifies this as a race condition where the lack of mutual exclusion produces a Time-of-Check to Time-of-Use (TOCTOU) gap or a use-after-free style window between threads.

Attack Vector

The attack vector is adjacent network, meaning the attacker must be within wireless range of the vulnerable host. No privileges and no user interaction are required. The attacker crafts a sequence of 802.11 frames or association events that race against an in-progress driver operation on a shared object. Winning the race causes the driver to operate on inconsistent state, leading to memory corruption and code execution.

No public proof-of-concept exploit is available, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft CVE-2026-32161 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-32161

Indicators of Compromise

• Unexpected crashes, bug checks, or stop errors referencing nwifi.sys or NDIS components in WER and minidump output.
• Anomalous kernel-mode process creation or driver load events following wireless association attempts from unknown access points.
• New or unsigned drivers loading shortly after wireless connection events on endpoints.

Detection Strategies

• Monitor Windows Event Log channels for Microsoft-Windows-WLAN-AutoConfig and Microsoft-Windows-NDIS warnings or errors clustered around association events.
• Hunt for kernel exploitation primitives such as token replacement, SYSTEM-context process spawns, and unexpected SMEP/SMAP violations on endpoints with wireless adapters.
• Correlate wireless probe and association telemetry with EDR process and driver-load events to detect adjacent attacker activity.

Monitoring Recommendations

• Enable verbose logging on wireless driver events and forward kernel crash dumps to a central analysis pipeline.
• Track patch deployment status for all wireless-capable Windows endpoints, especially mobile and field-deployed assets.
• Alert on repeated association failures or deauthentication storms that could indicate active race-window probing.

How to Mitigate CVE-2026-32161

Immediate Actions Required

• Apply the Microsoft May 2026 security updates referenced in the Microsoft CVE-2026-32161 Advisory to all affected Windows and Windows Server systems.
• Prioritize patching for mobile, laptop, and remote-work endpoints that connect to untrusted wireless networks.
• Inventory wireless-capable servers, including Windows Server 2012 through 2025, and confirm they require WiFi functionality.

Patch Information

Microsoft has published security updates addressing CVE-2026-32161 across all supported Windows 10, Windows 11, and Windows Server releases listed in the advisory. Administrators should deploy updates through Windows Update, WSUS, Microsoft Update Catalog, or their standard patch management workflow. Verify successful installation by checking installed update KB numbers against the Microsoft advisory after deployment.

Workarounds

• Disable the WLAN AutoConfig service (WlanSvc) on systems that do not require wireless connectivity until patching is complete.
• Remove or disable wireless network adapters on servers and fixed-location workstations where WiFi is unnecessary.
• Restrict wireless connections to known, authenticated enterprise SSIDs and avoid open or untrusted networks until updates are applied.

# Disable WLAN AutoConfig service on hosts that do not require WiFi
sc.exe config WlanSvc start= disabled
sc.exe stop WlanSvc

# Disable wireless adapters via PowerShell
Get-NetAdapter -Physical | Where-Object { $_.PhysicalMediaType -eq '802.11' } | Disable-NetAdapter -Confirm:$false