CVE-2026-58085: Missing MAC validation in wg(4) packet decryption
After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.
A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.
A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If possible, use network-level protections to prevent remote attackers from injecting or intercepting UDP traffic to the WireGuard endpoint (e.g., restrict inbound UDP access to the WireGuard port to trusted source IPs using a firewall/ACL).
Event History
Frequently Asked Questions
What network access does an attacker need to exploit this?
An attacker must be able to send UDP packets to a WireGuard endpoint and guess the bounds of the receiver's replay window. An on-path attacker able to intercept WireGuard packets destined for a FreeBSD host can also modify ciphertext and authenticated data without detection.
What is the practical impact of successful exploitation?
Forged or modified WireGuard transport data packets may be accepted by the affected receiver despite having an invalid Poly1305 authentication tag. This can allow injected data into the tunnel or undetected modification of intercepted packets.