Description
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.
Published: 2026-07-12
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A heap buffer overflow in Zephyr’s WireGuard receives system causes an out‑of‑bounds memory write when an incoming transport‑data packet is linearized into a used length occurs before the authentication check, meaning only a valid receiver session index is required. The result is remote memory corruption that, at minimum, can be used to reliably cause a denial of service or to corrupt nearby data.

Affected Systems

The vulnerability exists in Zephyr 4.4.0’s WireGuard implementation. Devices running that Zephyr release with WireGuard enabled are impacted.

Risk and Exploitability

The CVSS score of 7.4 indicates high severity. EPSS is reported as under 1%, implying a very low yet non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. An attacker can remotely send a crafted UDP packet to a WireGuard peer, causing the overflow by sending a data length larger than the configured buffer. Because authentication is not yet verified, only a valid session index is needed, so a compromised or malicious peer or an on‑path attacker with traffic control over an established session can trigger it.

Generated by OpenCVE AI on July 28, 2026 at 08:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a version that includes the fix, which adds bounds checking to net_buf_linearize and rejects packets larger than CONFIG_WIREGUARD_BUF_LEN, mitigating the CWE‑787 heap overflow.
  • If an immediate upgrade is not possible, disable WireGuard or limit its usage until a patch that addresses the CWE‑787 bounds check is applied.
  • Configure network filtering to drop UDP packets destined for the WireGuard tunnel that exceed the expected MTU, preventing oversized packets from reaching the vulnerable code and mitigating the CWE‑787 overflow.

Generated by OpenCVE AI on July 28, 2026 at 08:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 12 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Sun, 12 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
Description In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.
Title Heap buffer overflow on WireGuard receive path via unbounded incoming packet length
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-07-14T18:38:44.734Z

Reserved: 2026-06-02T15:25:26.403Z

Link: CVE-2026-10665

cve-icon Vulnrichment

Updated: 2026-07-13T15:49:05.088Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-28T08:15:06Z

Weaknesses