---
id: CVE-2026-10665
title: >-
  In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard),
  wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data
  payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before
  decryption
summary: >-
  In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard),
  wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data
  payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before
  decryption. The call net_…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-787
published: '2026-07-12'
updated: '2026-07-12'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10665'
references:
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/commit/6d8bb28dc9064e05e52b5a00b2998ecc663e38cb
    label: vulnerabilities@zephyrproject.org
  - url: >-
      https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3wqm-wgx2-9367
    label: vulnerabilities@zephyrproject.org
tags:
  - nvd
ingestedAt: '2026-07-12T17:20:29.612Z'
epss: 0.00602
epssPercentile: 0.46572
---

## Overview

In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.