Quick Look: CVE-2026-32161 — Windows Native WiFi Miniport Driver Race Condition Enables Adjacent Network RCE

Introduction

A race condition in the Windows Native WiFi Miniport Driver, patched in Microsoft's May 2026 Patch Tuesday, allows an unauthenticated attacker on an adjacent network to execute code remotely in kernel context. Windows 11 and Windows 10 together account for nearly 99 percent of the desktop OS market, so any device that connects to a shared or untrusted wireless network is a potential target for this flaw.

Technical Information

The vulnerability is in nwifi.sys, the kernel-mode Windows Native WiFi Miniport Driver. This component is part of the Native WiFi stack, which consists of drivers and wireless APIs that interact with wireless miniports and the supporting user-mode Wlansvc service. Two weaknesses combine to create the exploitable condition:

CWE-362 (Race Condition): Concurrent execution using a shared resource with improper synchronization. Within the driver, multiple threads can access the same memory object without adequate locking or synchronization primitives.

CWE-416 (Use After Free): One thread frees a memory object while another thread still holds a reference to it and continues to use it. This leaves a dangling pointer that, if dereferenced, can lead to arbitrary code execution.

This is a classic TOCTOU (Time-of-Check to Time-of-Use) scenario in driver code. A concurrent code path within the driver was accessing a memory object that another thread could free. An attacker who can influence the timing of these operations and control the contents of the freed memory region can redirect execution flow.

CVSS Vector Breakdown

The full CVSS 3.1 vector is AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 7.5 (High).

Adjacent Network (AV:A): The attacker must be on the same network segment as the target. The attack cannot cross routed boundaries, so the attacker must share the same network switch or virtual network. Shared WiFi environments (corporate offices, hotels, airports, conferences) are the primary attack surface.

High Attack Complexity (AC:H): Exploitation requires winning a race condition. The attacker does not fully control the timing conditions and network configurations it needs, so reliable exploitation across diverse environments is difficult.

No Privileges Required (PR:N) and No User Interaction (UI:N): The attacker does not need any credentials on the target system, and the victim does not need to do anything.

Full CIA Impact (C:H/I:H/A:H): A successful exploit fully compromises confidentiality, integrity, and availability, consistent with kernel-level code execution.

Attack Flow

Based on the vulnerability characteristics, an attacker would need to:

1. Get onto the same network segment as the target (e.g., join the same WiFi network).
2. Send specially crafted wireless frames or network traffic that triggers the vulnerable code path in the WiFi miniport driver.
3. Race the timing of concurrent operations within the driver to cause the use-after-free condition, where one thread frees a memory object while another thread still references it.
4. Control the contents of the freed memory (e.g., through heap spraying or similar techniques) so that when the dangling pointer is dereferenced, execution is redirected to attacker-controlled code.
5. Achieve arbitrary code execution in kernel context on the target system.

The high attack complexity rating reflects the difficulty of step 3: reliably winning the race across different hardware configurations, driver versions, and system loads.

Patch Information

Microsoft released an official fix for CVE-2026-32161 in the May 12, 2026 Patch Tuesday cumulative security updates. The remediation level is classified as "Official Fix," which means a complete vendor solution is available.

Because nwifi.sys is a closed-source kernel-mode driver, no source-level diff is publicly available. The nature of the fix can still be inferred from the listed weaknesses: the patch corrects improper synchronization around shared resources within the WiFi miniport driver. The update adds proper locking or reference counting so the memory object stays valid throughout its use, which removes the dangling pointer that an adjacent-network attacker could race to exploit.

The fix covers a wide range of Windows versions. The table lists the key Knowledge Base articles and the patched build number for each product family:

All updates are rated Critical and marked as "Customer Action Required." For Windows 11 24H2/25H2 and Windows Server 2025, Microsoft also provides a Security Hotpatch option (KB5089466 and KB5087423 respectively) that applies the fix without a full reboot, a significant advantage for server environments that need to minimize downtime.

To verify that your systems are patched, compare the OS build number (shown by winver or systeminfo) against the patched build numbers in the table. Updates are available through Windows Update, WSUS, and the Microsoft Update Catalog.

Network-Level Mitigations

For organizations that cannot patch immediately, Cisco Talos has released Snort rules that detect exploitation attempts:

• Snort 2 SIDs: 1:66438 through 1:66445, 1:66451 through 1:66460, 1:66470 through 1:66476
• Snort 3 SIDs: 1:301494 through 1:301497, 1:301500 through 1:301506, 1:66472 through 1:66473, 1:66476

Administrators should update their Cisco Security Firewall rulesets and open-source Snort Subscriber Rulesets to the latest versions.

Affected Systems and Versions

The vulnerability affects the Windows Native WiFi Miniport Driver (nwifi.sys) across a broad range of Windows client and server versions:

Windows Client:

• Windows 11 26H1 (x64, ARM64)
• Windows 11 25H2 (x64, ARM64)
• Windows 11 24H2 (x64, ARM64)
• Windows 11 23H2 (x64, ARM64)
• Windows 10 22H2 (32 bit, x64, ARM64)
• Windows 10 21H2 (32 bit, x64, ARM64)
• Windows 10 1809 (32 bit, x64)
• Windows 10 1607 (32 bit, x64)

Windows Server:

• Windows Server 2025 (including Server Core)
• Windows Server 2022 23H2 (Server Core)
• Windows Server 2022 (including Server Core)
• Windows Server 2019 (including Server Core)
• Windows Server 2016 (including Server Core)
• Windows Server 2012 R2 (including Server Core)
• Windows Server 2012 (including Server Core)

Any unpatched Windows device with a WiFi adapter that connects to shared, public, or untrusted wireless networks is potentially exposed to attackers on the same network.

References

• NVD Entry for CVE-2026-32161
• Microsoft Security Update Guide: CVE-2026-32161
• BleepingComputer: Microsoft May 2026 Patch Tuesday fixes 120 flaws, no zero days
• Cisco Talos: Microsoft Patch Tuesday for May 2026
• Tenable: May 2026 Microsoft Patch Tuesday
• Microsoft Learn: Wireless network connectivity issues troubleshooting
• StatCounter: Windows Version Market Share Worldwide
• Microsoft Update Catalog