CVE-2026-10665: bounds in zephyrproject zephyr
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.
AI Analysis
Technical Summary
In Zephyr 4.4.0's WireGuard implementation, the function wg_process_data_message() linearizes inbound transport-data payloads into a fixed-size buffer of CONFIG_WIREGUARD_BUF_LEN bytes. The length parameter data_len, derived from the UDP datagram length, is used as both the destination capacity and copy length in net_buf_linearize(), bypassing internal length bounds. When data_len exceeds CONFIG_WIREGUARD_BUF_LEN, this results in an out-of-bounds write (CWE-787) before authentication verification. This vulnerability can be exploited remotely by an attacker with a valid receiver session index, leading to memory corruption and denial of service. The patch adds explicit rejection of data_len values greater than the buffer size and corrects the linearize call to use the actual buffer capacity.
Potential Impact
The vulnerability allows remote attackers who have a valid receiver session index to cause memory corruption or denial of service on affected Zephyr 4.4.0 devices running the WireGuard subsystem. Because the overflow occurs before authentication checks, exploitation does not require a valid authenticator, increasing the attack surface. This can lead to service disruption or potentially more severe impacts depending on the memory corruption consequences.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding explicit checks to reject data_len values exceeding CONFIG_WIREGUARD_BUF_LEN and correcting buffer handling in wg_process_data_message(). Until an official patch or update is available, avoid using affected versions in exposed environments or apply any vendor-provided mitigations.
CVE-2026-10665: bounds in zephyrproject zephyr
Description
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.
CVSS v3.1
Score 7.4high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Zephyr 4.4.0's WireGuard implementation, the function wg_process_data_message() linearizes inbound transport-data payloads into a fixed-size buffer of CONFIG_WIREGUARD_BUF_LEN bytes. The length parameter data_len, derived from the UDP datagram length, is used as both the destination capacity and copy length in net_buf_linearize(), bypassing internal length bounds. When data_len exceeds CONFIG_WIREGUARD_BUF_LEN, this results in an out-of-bounds write (CWE-787) before authentication verification. This vulnerability can be exploited remotely by an attacker with a valid receiver session index, leading to memory corruption and denial of service. The patch adds explicit rejection of data_len values greater than the buffer size and corrects the linearize call to use the actual buffer capacity.
Potential Impact
The vulnerability allows remote attackers who have a valid receiver session index to cause memory corruption or denial of service on affected Zephyr 4.4.0 devices running the WireGuard subsystem. Because the overflow occurs before authentication checks, exploitation does not require a valid authenticator, increasing the attack surface. This can lead to service disruption or potentially more severe impacts depending on the memory corruption consequences.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described fix involves adding explicit checks to reject data_len values exceeding CONFIG_WIREGUARD_BUF_LEN and correcting buffer handling in wg_process_data_message(). Until an official patch or update is available, avoid using affected versions in exposed environments or apply any vendor-provided mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- zephyr
- Date Reserved
- 2026-06-02T15:25:26.403Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a54991068715ace436e94dc
Added to database: 07/13/2026, 07:51:44 UTC
Last enriched: 07/20/2026, 19:10:32 UTC
Last updated: 08/28/2026, 05:03:05 UTC
Views: 118
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.