FreeBSD WireGuard CVE-2026-58085

The target must be a FreeBSD host running the wg(4) WireGuard driver at an unpatched version (14.4-RELEASE before p8, 15.0-RELEASE before p12, or 15.1-RELEASE before p2) with at least one active WireGuard interface. Two distinct exploitation prerequisites exist depending on attack path: for packet injection, the attacker must be able to send UDP packets to the WireGuard endpoint's listening port AND possess knowledge of (or ability to guess) the receiver's current replay window counter bounds - replay window awareness is a non-default, time-sensitive knowledge requirement. For the MITM modification attack, the attacker must hold a privileged on-path network position enabling interception of WireGuard UDP packets in transit between legitimate peers, such as routing-level access, ARP cache poisoning on a shared segment, or a compromised intermediate hop. What limits exploitation: the injection attack is constrained by replay window guessing difficulty; the MITM attack requires an on-path network position that is not available to a generic internet adversary; both attacks are integrity-only - confidentiality of the tunnel (encryption via ChaCha20) is not broken by this flaw.

The official CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-accessible, unauthenticated integrity compromise, but AC:L overstates the ease of exploitation in practice. The injection attack path explicitly requires the attacker to guess the bounds of the receiver's replay window - a non-trivial, knowledge-dependent condition - while the MITM modification path requires a privileged on-path network position to intercept WireGuard UDP traffic in transit. Neither condition is met by a generic internet adversary, making this less exploitable than a raw CVSS 7.5 implies. EPSS at 0.18% (8th percentile) is consistent with these barriers and shows no evidence of tooling or mass exploitation. There is no CISA KEV listing, confirming no observed active exploitation. The severity of a successful exploitation is significant: the attacker can forge or modify tunnel traffic without the FreeBSD host detecting tampering, undermining any security relying on WireGuard tunnel integrity. However, confidentiality is not compromised - ChaCha20 encryption remains intact, so traffic contents cannot be read by a passive observer. The real priority is highest for FreeBSD WireGuard deployments on adversarial networks (public internet endpoints, multi-tenant environments) and lower for internally-connected peers.

An attacker with on-path access to a network segment carrying WireGuard UDP traffic - achieved, for example, via ARP spoofing on a local segment, a rogue BGP advertisement, or a compromised transit router - intercepts a legitimate WireGuard transport packet destined for an unpatched FreeBSD host, modifies the encrypted payload or associated data, and forwards the packet. The FreeBSD wg(4) driver decrypts the packet via OCF, ignores the failed Poly1305 MAC result, and delivers the forged plaintext to the application layer without raising any error. No public proof-of-concept code has been identified at time of analysis.