CVE-2026-58085

Name of the Vulnerable Software and Affected Versions pfSense Plus versions prior to 26.07

Description The wg(4) driver fails to verify if the MAC verification step succeeded after receiving a decryption result from OCF. This allows the driver to silently accept packets containing an invalid Poly1305 authentication tag. A remote attacker capable of sending UDP packets to a WireGuard endpoint and guessing the receiver's replay window bounds can inject forged or modified transport data packets into the tunnel. Additionally, an attacker intercepting packets bound for a FreeBSD host can modify the ciphertext and authenticated data without being detected by the receiver.

Recommendations Update pfSense Plus to version 26.07.