CVE-2026-32161

What it actually does

This is a race condition in the Windows Native WiFi Miniport Driver, likely involving unsafe concurrent access to a shared kernel resource during wireless networking operations. An unauthenticated attacker within adjacent wireless range could trigger the race without user interaction and, if timing conditions are met, execute arbitrary code on the affected Windows system. Because the flaw is in a driver, successful exploitation may provide high-privilege code execution and can affect confidentiality, integrity, and availability. Exploitation complexity is high, and no public exploit maturity is currently reported.

Why it matters to the business

Affected Windows desktops, laptops, and servers with Wi-Fi capability could be compromised by an attacker physically nearby or otherwise able to interact with the same wireless radio environment. A successful attack could lead to device takeover, credential theft, malware deployment, lateral movement, or system crashes. The current EPSS score is low and stable, and the issue is not listed in CISA KEV or associated with ransomware, but the broad Windows footprint means organizations should still prioritize normal patch cycles, especially for mobile endpoints, executive devices, shared workstations, and any servers with wireless adapters enabled.

How an attack unfolds

An attacker positions themselves within wireless range of a vulnerable Windows device whose Wi-Fi interface is enabled. The attacker sends specially crafted wireless traffic intended to exercise vulnerable code paths in the Windows Native WiFi Miniport Driver. By repeatedly triggering concurrent driver operations, the attacker attempts to win a timing-dependent race condition involving an improperly synchronized shared resource. If the race is won in a controlled way, memory or driver state may be corrupted and redirected toward attacker-controlled execution. Successful exploitation can result in code running on the victim system without credentials or user interaction; failed attempts may cause wireless instability or system crashes.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, Server 2022 23H2, and Server 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, or equivalent patch management to ensure updates released on or after the May 2026 security release are installed. Where immediate patching is not possible, reduce exposure by disabling Wi-Fi adapters on systems that do not require wireless connectivity, especially servers; prefer wired networking for high-value assets; restrict use of unmanaged wireless networks; and monitor for wireless-driver crashes or anomalous WLAN behavior. These mitigations reduce attack surface but should not be treated as substitutes for patching.

How to confirm the fix worked

Confirm that affected systems have installed the applicable Microsoft cumulative/security update containing the fix. Validate through Windows Update history, enterprise patch compliance tooling, OS build/revision inventory, or Microsoft vulnerability management reporting. Confirm that wireless adapters are disabled on systems where Wi-Fi is not required. For exposure validation, inventory Windows systems with active Wi-Fi interfaces and affected OS versions, then prioritize those that are mobile, frequently used in public locations, or located in areas accessible to untrusted adjacent wireless activity. After remediation, monitor for absence of recurring WLAN driver crashes, bugchecks referencing nwifi.sys, and unexplained wireless service instability.

Typical attack path

1. Identify Windows systems with enabled Wi-Fi adapters within adjacent wireless range.
2. Generate crafted wireless traffic targeting Native WiFi driver behavior such as scanning, association, roaming, or packet handling paths.
3. Repeatedly trigger the vulnerable concurrent code path to create the race condition window.
4. Win the timing condition and corrupt driver state or memory in a controlled manner.
5. Achieve code execution on the target system, likely with kernel-level or highly privileged context.
6. Use the foothold to deploy malware, dump credentials, disable security controls, or move laterally.

How to detect it

There are no public, unique exploitation indicators for this vulnerability, and successful exploitation of a kernel Wi-Fi driver may leave few reliable logs. Detection should focus on weak signals before exploitation and stronger signs after exploitation. Review Windows System event logs, crash dumps, Windows Error Reporting data, WLAN AutoConfig operational logs, EDR telemetry, and network security telemetry for repeated Wi-Fi driver instability, bugchecks, or crashes referencing the Native WiFi driver. Look for bursts of WLAN failures or association/roaming anomalies immediately followed by suspicious process execution, privilege escalation behavior, credential access, EDR tampering, new services, scheduled tasks, or unexpected outbound connections. If crash dumps are available, triage bugchecks involving nwifi.sys or Native WiFi components, especially on systems that were in public or untrusted wireless environments. Treat the listed IOCs as hunt strings and triage pivots rather than definitive proof of exploitation.

• nwifi.sys
• NativeWiFi
• Native WiFi
• Microsoft-Windows-WLAN-AutoConfig
• WLAN-AutoConfig
• DRIVER_IRQL_NOT_LESS_OR_EQUAL
• IRQL_NOT_LESS_OR_EQUAL
• KMODE_EXCEPTION_NOT_HANDLED
• SYSTEM_THREAD_EXCEPTION_NOT_HANDLED
• PAGE_FAULT_IN_NONPAGED_AREA
• BugCheck
• Windows Error Reporting
• LiveKernelEvent

What your security team should do

• Patch affected Windows endpoints and servers through normal security update channels, prioritizing systems with enabled Wi-Fi and mobile users.
• Inventory systems with active wireless adapters, especially servers and privileged-user workstations, and disable Wi-Fi where it is not operationally required.
• Prioritize executive, administrator, developer, helpdesk, and remote-worker devices because adjacent-network compromise can become a credential-theft and lateral-movement path.
• Review endpoint protection and EDR coverage for kernel-driver crash telemetry, suspicious post-exploitation activity, and anomalous child processes following WLAN instability.
• Monitor WLAN and system logs for repeated wireless driver errors, bugchecks, or crashes referencing Native WiFi components such as nwifi.sys.
• Because exploitation requires adjacent network access and has high complexity, balance urgency against actively exploited vulnerabilities, but do not defer beyond the next standard Windows patch cycle.