EUVD-2026-54975
GHSA-vfrx-fwf3-jfq2
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Strictly local attack requiring high privileges with only low availability impact and no confidentiality or integrity effect, consistent with the provided CVSS 4.0 metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
AnalysisAI
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
Technical ContextAI
wireguard.sys is a Windows kernel-mode driver distributed by Mullvad VPN to implement the WireGuard tunneling protocol. Kernel drivers expose IOCTL (I/O Control Code) interfaces that allow privileged userspace processes to send control commands directly to the driver. The affected AdapterState function within this IOCTL handler fails to properly update reference counts (CWE-911 - Improper Update of Reference Count). In kernel programming, reference counts track how many entities hold a pointer to an object; mismanagement can cause premature object release or use-after-free conditions, potentially destabilizing the driver. The CPE string cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:* identifies the affected component as Mullvad's wireguard.sys application, with version 0.10.1 specifically named. The CVSS 4.0 vector confirms the attack is strictly local (AV:L) and requires high privileges (PR:H), consistent with interaction via a privileged IOCTL interface.
RemediationAI
No vendor-released patched version is confirmed from available data. Monitor Mullvad's official release channels and the VulDB tracking page at https://vuldb.com/vuln/387273 for a patched build of wireguard.sys. As a compensating control, restrict access to the Mullvad driver's IOCTL interface by limiting who holds local administrator privileges on affected endpoints - this directly raises the barrier for exploitation given the PR:H requirement. On systems where Mullvad VPN is not operationally required, consider uninstalling the client to eliminate the attack surface entirely; this has no side effects beyond loss of VPN functionality. Do not rely on network-layer controls as mitigations, since the attack vector is strictly local.
Same weakness CWE-911 – Improper Update of Reference Count
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today