CVE-2026-10665
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In Zephyr's WireGuard subsystem, wg_process_data_message() linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The net_buf_linearize() call passes the attacker-derived data_len as both destination capacity and copy length, bypassing the function's internal bound. When data_len exceeds CONFIG_WIREGUARD_BUF_LEN, an out-of-bounds write (CWE-787) occurs.
Risk Assessment
A malicious or compromised peer, or an on-path attacker for an established session, can remotely cause memory corruption, leading to at least a reliable denial of service (DoS). The vulnerability is reachable before the Poly1305 authentication check, requiring only a valid receiver session index.
Recommendation
Immediately update Zephyr to a version containing the fix, which adds an explicit rejection of data_len > CONFIG_WIREGUARD_BUF_LEN and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.
Related vulnerabilities
- CVE-2026-19117Critical
Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only.
- CVE-2026-66786Critical
In Submariner's cert-auth mode, connection configuration is built from unvalidated free-form strings from the CRD. A malicious cluster can publish a CableName with newlines and ipsec.conf directives, allowing injection of arbitrary configuration or command execution via leftupdown hooks, leading to remote code execution as root on the gateway node.
- CVE-2026-53671Critical
In the PREVAIL eBPF verifier before version 0.2.4, the abstract transformer treats writes through a T_CTX-typed base register as a silent no-op. An attacker can craft an eBPF program that overwrites a context field, reloads it as T_PACKET, and dereferences an attacker-controlled address, and PREVAIL will report the program as safe.
- CVE-2026-53670Critical
In the PREVAIL eBPF verifier before version 0.2.4, EbpfTransformer::add() silently skips offset-variable updates when the destination register carries a non-singleton typeset. Subsequent bounds checks use the stale offset and accept out-of-bounds memory accesses, so a crafted BPF program passes verification even though it would corrupt memory at runtime.
- CVE-2026-53649Critical
Joro before version 1.1.1 in default proxy mode exposes a local API on 127.0.0.1:9090 with no authentication and wildcard CORS. A malicious website can reach privileged endpoints, including uploading a native plugin and triggering a restart, leading to unauthenticated remote code execution as the operator's user.
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20212Critical
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. TCP ports 43210 and 43211 are accessible in the default L3 VRF, and crafted input can lead to code execution or crash of the S1HAL process causing device reload.
- CVE-2026-53611Critical
Looking Glass prior to version 1.3.5 contains an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- CVE-2026-82955Critical
In the current development version of Eclipse aeriOS, the KrakenD instance in the API Gateway had disable_jwk_security hard-coded to true, disabling TLS certificate verification when retrieving JWKS. This could allow an attacker to intercept communication and provide a malicious JWKS, compromising token validation. The issue has been fixed by making the parameter configurable and defaulting to false.
Original NVD description (English source)
In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.