CVE-2026-13734
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Zephyr's WireGuard VPN: wg_process_data_message() validated the anti-replay counter too late, after committing peer-state changes (address update, timers, key rotation). An attacker can re-inject a captured packet, leading to endpoint hijacking and session disruption.
Risk Assessment
Risk includes redirecting tunnel traffic to an attacker-chosen address (roaming hijack) and prematurely destroying the previous session key, causing VPN outages. The attack requires no credentials and can be performed by a network observer.
Recommendation
Apply the fix that moves wg_check_replay() immediately after successful decryption, before any peer-state mutation. Update to a Zephyr version containing this patch.
Other vulnerabilities in Zephyr
See all- CVE-2026-10772Unknown
This CVE has been rejected as a duplicate. The described vulnerability involved incorrect permission checking in the Bluetooth GATT notify/indicate paths in the Zephyr stack, but was already reported as CVE-2026-2411.
- CVE-2026-10676Unknown
CVE-2026-10676 has been withdrawn as analysis determined that the reported defect is not reachable in any released version of Zephyr. In every supported release, the affected value is corrected before use.
- CVE-2026-5067Critical
Zephyr OS has a memory corruption vulnerability in the HTTP server WebSocket upgrade path. An unauthenticated remote attacker can trigger it by sending a crafted Sec-WebSocket-Key header. The bounded copy does not guarantee NUL termination, leading to out-of-bounds read/write on stack.
- CVE-2026-13735Low
Zephyr's WireGuard implementation mishandled keepalive packets. A type-4 message with a 16-byte payload (empty plaintext plus Poly1305 tag) was accepted without tag verification because wg_process_data_message() returned early before calling wg_decrypt_packet(). An attacker could send a forged keepalive without knowing the session key.
- CVE-2026-13212High
The Zephyr virtio driver does not validate the descriptor-chain head id written by the virtio device into the used ring. A malicious virtio backend can supply an out-of-range id, causing an out-of-bounds read and invocation of an attacker-controlled function pointer in the guest's interrupt context. This enables control-flow hijacking or a reliable crash.
- CVE-2026-12634Medium
A vulnerability in the NVS backend of the Zephyr settings subsystem (settings_nvs.c) causes an out-of-bounds stack write. The nvs_read() function returns the full entry length, which can exceed the buffer size, and the code uses this value as an index for writing a NUL character, leading to a write past the buffer (CWE-787).
- CVE-2026-12632Medium
A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.
- CVE-2026-12630Medium
Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.
- CVE-2026-12366High
A use-after-free vulnerability exists in Zephyr's dynamic kernel-object disposal path. The unref_check() function frees object storage when the reference count reaches zero, but for timers (K_OBJ_TIMER) it does not cancel the active timeout, leaving a dangling node in the global timeout queue. When the timer expires, the kernel invokes the expiration handler on freed memory, causing a write to freed heap.
- CVE-2026-12365Medium
A use-after-free vulnerability exists in the Zephyr second-generation work queue (kernel/work.c) in the handling of delayable work timeouts. When a delayable work item's timeout has been dequeued and its handler work_timeout() is in flight (blocked acquiring the work-queue spinlock), a concurrent cancellation does not wait for that handler to finish. This allows k_work_cancel_delayable_sync() and k_work_flush_delayable() to return without blocking, and freeing the object leads to a use-after-free read and write.
Original NVD description (English source)
Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back. The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c. Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.