Executive brief
A vulnerability exists in the Windows driver responsible for managing wireless network connections. An attacker located on the same local or Wi-Fi network could exploit this flaw to gain control over a target computer. Successful exploitation could lead to unauthorized access to sensitive data, system instability, or the installation of malicious software.
Technical details
A race condition (CWE-362) exists in the Windows Native WiFi Miniport Driver due to improper synchronization when accessing shared resources. This flaw can lead to a Use-After-Free (CWE-416) condition. An unauthenticated attacker located on the same local network segment (adjacent) can exploit this vulnerability without user interaction, though the attack complexity is high due to the timing requirements of the race condition. Successful exploitation allows for remote code execution (RCE) with kernel-level privileges. Microsoft has released security updates to address this issue.
Affected products
- Microsoft Windows Native WiFi Miniport Driver
Timeline
- 2026-05-12: advisory: Initial disclosure by Microsoft and NVD.