CVE-2026-13734

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The WireGuard VPN data-plane receive handler wg process data message() in subsys/net/lib/wireguard/wg crypto.c validates the anti-replay counter too late. After successful AEAD (Authenticated Encryption with Associated Data) decryption of a MESSAGE TRANSPORT DATA packet, the system commits peer-state changes—including update peer addr() for endpoint roaming, liveness timers, and keypair update()—before calling wg check replay(). Since AEAD authenticates content but not freshness, an attacker can capture a valid ciphertext and re-inject it from a spoofed source address.

This allows an attacker to repoint the peer endpoint to an arbitrary address, redirecting outbound tunnel traffic, prematurely destroying the previous keypair, and refreshing the RX liveness timer. This results in an integrity and availability impact through traffic redirection and session disruption, although the payload remains encrypted. The issue is triggered via inbound UDP datagrams in subsys/net/lib/wireguard/wg.c and requires no credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.