Mullvad wireguard.sys CVE-2026-19380

Exploitation requires an attacker to have local, high-privilege (administrator-level) access to a Windows system with Mullvad VPN and wireguard.sys 0.10.1 installed. The vulnerability is reached only through the IOCTL handler interface exposed by the kernel driver - specifically the AdapterState function - meaning the attacker must be able to open and communicate with the driver from a privileged userspace context. Network-based exploitation is definitively excluded by AV:L in the CVSS vector. Limiting factors include the strict local-access-only constraint, the requirement for high privileges (PR:H), and the low severity of the resulting impact (minor availability degradation, no data exposure or code execution). The 'Information Disclosure' tag from VulDB is not corroborated by the CVSS impact metrics and should not be treated as a confirmed confidentiality exposure without further vendor clarification.

The overall risk profile of CVE-2026-19380 is low in practice. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) requires local system access with high privileges - an attacker must already control an administrator-level account on the target machine. The sole impact is low availability on the vulnerable system (VA:L), with no confidentiality or integrity effect confirmed by the CVSS metrics. The EPSS score was not provided, but the combination of local-only access, high-privilege requirement, and minimal impact suggests very limited exploitation utility. While a public proof-of-concept is available (E:P), its weaponization potential is constrained by these prerequisites - even a mid-sized municipal IT team in swidnica managing a fleet of Mullvad-equipped endpoints should treat this as a low-urgency maintenance patch rather than an emergency response item. The 'Information Disclosure' tag applied by VulDB appears inconsistent with the CVSS impact metrics (VC:N/VI:N), and no CISA KEV listing exists to indicate active exploitation campaigns.

A local administrator on a Windows system running Mullvad VPN 0.10.1 opens the kernel driver's IOCTL interface and sends a specially crafted control code targeting the AdapterState function, triggering improper reference count behavior. A public proof-of-concept demonstrating this interaction is available via a shared Google Drive link cited in VulDB's advisory. The result is driver instability or a crash of the WireGuard adapter, disrupting VPN tunnel connectivity until the service is restarted.