CVE-2026-13735

Name of the Vulnerable Software and Affected Versions Zephyr (affected versions not specified)

Description The WireGuard implementation in subsys/net/lib/wireguard/wg crypto.c mishandles keepalive packets. In the wg process data message() function, type-4 transport-data messages with a payload of exactly 16 bytes (consisting of empty plaintext and a Poly1305 tag) are accepted and returned before wg decrypt packet() is called. This allows the Poly1305 authentication tag to bypass verification, relying only on a cleartext receiver-index lookup via get peer keypair for index() on the data hdr->receiver variable and a non-cryptographic keypair check.

This path is accessible via the network through inbound UDP on the WireGuard port, processed by wg input(), handle transport data(), and wg process data message(). An attacker can obtain the 32-bit receiver index by observing network traffic or through brute-force. By sending a 16-byte garbage payload, an attacker can trigger a spoofed NET EVENT VPN CONNECTED signal and increment the keepalive-RX statistic without possessing the session key. The impact is limited to the integrity of this status signal, as no plaintext is decrypted, no keys are disclosed, and no traffic injection or session takeover is possible.

Recommendations Update the software to a version where the pre-decrypt early return in wg process data message() is removed, ensuring 16-byte payloads are processed by wg decrypt packet() for Poly1305 tag verification and anti-replay checks.