EUVD-2026-62339
GHSA-ph3x-qgrx-fv78
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Both attack paths require either on-path MITM positioning or replay-window guessing, justifying AC:H; integrity-only impact as ChaCha20 confidentiality is unbroken.
Primary rating from Vendor (freebsd).
CVSS VectorVendor: freebsd
Lifecycle Timeline
4DescriptionCVE.org
After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.
A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.
A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.
AnalysisAI
FreeBSD's wg(4) WireGuard kernel driver silently accepts packets bearing invalid Poly1305 authentication tags, completely defeating WireGuard's cryptographic integrity guarantee on affected FreeBSD versions. The driver dispatches decrypt operations to the OpenCrypto Framework (OCF) but never checks the returned MAC verification result, meaning tampered or forged ciphertext passes through as legitimate plaintext. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a FreeBSD host running the wg(4) WireGuard driver at an unpatched version (14.4-RELEASE before p8, 15.0-RELEASE before p12, or 15.1-RELEASE before p2) with at least one active WireGuard interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects a network-accessible, unauthenticated integrity compromise, but AC:L overstates the ease of exploitation in practice. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply FreeBSD patches from the official security advisory FreeBSD-SA-26:52.if_wg at https://security.freebsd.org/advisories/FreeBSD-SA-26:52.if_wg.asc: upgrade to FreeBSD 14.4-RELEASE-p8, FreeBSD 15.0-RELEASE-p12, or FreeBSD 15.1-RELEASE-p2 respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FreeBSD systems running WireGuard and classify their criticality and network role. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today