CVE-2026-79977

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The experimental WireGuard VPN service contains a flaw in the handle transport data() function within subsys/net/lib/wireguard/wg.c. When an incoming transport-data message has a receiver index that matches no session, the system copies the source address of the datagram into peer->endpoint using memcpy() without authentication. Since the receiver index is unknown, there is no key to verify the message, allowing an attacker to supply an arbitrary address.

An attacker can send a spoofed 16-byte UDP datagram to the default port 51820 to redirect a peer's traffic to an address of their choice. This occurs when the peer lacks a valid handshake or current keypair, such as during boot or after session expiration. This redirection causes subsequent handshake initiations, keepalives, and encrypted data packets to be sent to the attacker's address, resulting in a loss of availability. Additionally, an attacker can relay these initiations to the real peer to position themselves in the traffic path to observe ciphertext and metadata. End-to-end cryptography remains intact, preventing decryption or forgery of the content.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, disable the CONFIG WIREGUARD configuration if it is enabled.