WireGuard (Subsys/Net/Lib/Wireguard/Wg.c) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wireguard-subsys/net/lib/wireguard/wg.c/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 22:04:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWireGuard: Peer endpoint hijacking via unauthenticated UDP packets (CVE-2026-79977)https://feed.craftedsignal.io/briefs/2026-10-wireguard-endpoint-hijack/Fri, 23 Oct 2026 22:04:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wireguard-endpoint-hijack/A vulnerability in the WireGuard implementation (subsys/net/lib/wireguard/wg.c) allows an off-path attacker to redirect peer traffic by sending an unauthenticated UDP datagram.The WireGuard implementation in subsys/net/lib/wireguard/wg.c updates the peer endpoint from an unauthenticated transport-data message. In handle_transport_data(), if the 32-bit receiver index of an incoming message does not match a session, the code copies the datagram's source address into peer->endpoint using memcpy. Because the receiver index is unknown and unverified, an attacker can supply an arbitrary address.

The listener, which defaults to UDP port 51820, does not filter by remote address or cryptographic identity, allowing any host capable of sending a UDP datagram to trigger this update if the peer lacks a valid handshake or current keypair. This redirects subsequent handshake initiations, keepalives, and encrypted data to the attacker-supplied address, causing a loss of availability and potential man-in-the-middle positioning. End-to-end cryptography prevents decryption or forgery of tunnel content. CONFIG_WIREGUARD is experimental and not enabled by default.

]]>highadvisory