Description
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Published: 2026-08-10
Score: 4.6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the AdapterState function of the IOCTL handler in Mullvad's wireguard.sys 0.10.1. Improper update of reference count can cause the driver to mismanage resources, potentially leading to a memory corruption or crash that results in denial of service for the local user. This flaw requires local access to the machine, so an attacker needs to be able to execute code on the target system.

Affected Systems

The affected product is Mullvad's wireguard.sys version 0.10.1. No other versions or vendors are listed in the current data, so targeting is limited to installations running this specific release.

Risk and Exploitability

The CVSS score of 4.6 indicates a medium severity flaw. Because the EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, the publicly available exploit still represents a moderate risk scenario; an attacker with local privileges could exploit the flaw to crash the driver and stop the VPN service, which may disrupt user connectivity.

Generated by OpenCVE AI on August 10, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Mullvad to the latest release that addresses the reference count bug.
  • If an upgrade is not immediately possible, disable the wireguard.sys driver or suspend the Mullvad VPN service until a patch is applied.
  • Restrict local user privileges to limit the ability to execute the vulnerable IOCTL operation.

Generated by OpenCVE AI on August 10, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 10 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Title Mullvad wireguard.sys IOCTL AdapterState reference count
First Time appeared Mullvad
Mullvad wireguard.sys
Weaknesses CWE-664
CWE-911
CPEs cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:*
Vendors & Products Mullvad
Mullvad wireguard.sys
References
Metrics cvssV2_0

{'score': 1.4, 'vector': 'AV:L/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 2.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 2.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 4.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Mullvad Wireguard.sys
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-10T00:15:09.720Z

Reserved: 2026-08-09T15:13:18.154Z

Link: CVE-2026-19380

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T01:30:10Z

Weaknesses
  • CWE-664

    Improper Control of a Resource Through its Lifetime

  • CWE-911

    Improper Update of Reference Count