In Zephyr's WireGuard implementation, the function wg_process_data_message() linearizes incoming transport-data payloads into a fixed-size buffer of CONFIG_WIREGUARD_BUF_LEN bytes. The length parameter data_len, derived from the UDP datagram length, is used both as the destination capacity and copy length in net_buf_linearize(), bypassing internal length bounds checks. When data_len exceeds the buffer size, an out-of-bounds write occurs before the Poly1305 authentication check, allowing a remote attacker with a valid session index to cause memory corruption or denial of service. The vulnerability is present in Zephyr 4.4.0 and versions >=4.4.0 <4.5.0. The fix involves rejecting data_len values larger than the buffer and correcting the linearize call to use the actual buffer capacity.

This vulnerability allows a remote attacker who can send packets to an established WireGuard session to cause out-of-bounds memory writes, leading to memory corruption. The impact includes reliable denial of service and potentially other integrity issues. Confidentiality is not affected. Exploitation requires a valid receiver session index but no valid authentication token, lowering the barrier for an attacker controlling or compromising a peer or an on-path attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix adds explicit rejection of data_len values exceeding CONFIG_WIREGUARD_BUF_LEN and corrects the buffer linearization call. Until an official patch or update is available, consider restricting or monitoring WireGuard traffic to trusted peers only, and avoid configurations where the buffer size is smaller than the link MTU or where fragmented packets could exceed the buffer size.