{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wireguard-subsys/net/lib/wireguard/wg.c/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-79977"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WireGuard (subsys/net/lib/wireguard/wg.c)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe WireGuard implementation in \u003ccode\u003esubsys/net/lib/wireguard/wg.c\u003c/code\u003e updates the peer endpoint from an unauthenticated transport-data message. In \u003ccode\u003ehandle_transport_data()\u003c/code\u003e, if the 32-bit receiver index of an incoming message does not match a session, the code copies the datagram's source address into \u003ccode\u003epeer-\u0026gt;endpoint\u003c/code\u003e using \u003ccode\u003ememcpy\u003c/code\u003e. Because the receiver index is unknown and unverified, an attacker can supply an arbitrary address.\u003c/p\u003e\n\u003cp\u003eThe listener, which defaults to UDP port 51820, does not filter by remote address or cryptographic identity, allowing any host capable of sending a UDP datagram to trigger this update if the peer lacks a valid handshake or current keypair. This redirects subsequent handshake initiations, keepalives, and encrypted data to the attacker-supplied address, causing a loss of availability and potential man-in-the-middle positioning. End-to-end cryptography prevents decryption or forgery of tunnel content. \u003ccode\u003eCONFIG_WIREGUARD\u003c/code\u003e is experimental and not enabled by default.\u003c/p\u003e\n","date_modified":"2026-10-23T22:04:43Z","date_published":"2026-10-23T22:04:43Z","id":"https://feed.craftedsignal.io/briefs/2026-10-wireguard-endpoint-hijack/","summary":"A vulnerability in the WireGuard implementation (subsys/net/lib/wireguard/wg.c) allows an off-path attacker to redirect peer traffic by sending an unauthenticated UDP datagram.","title":"WireGuard: Peer endpoint hijacking via unauthenticated UDP packets (CVE-2026-79977)","url":"https://feed.craftedsignal.io/briefs/2026-10-wireguard-endpoint-hijack/"}],"language":"en","title":"CraftedSignal Threat Feed - WireGuard (Subsys/Net/Lib/Wireguard/Wg.c)","version":"https://jsonfeed.org/version/1.1"}