Vulnerability · Published Aug 10, 2026 · Assigned by VulDB
CVE-2026-19380Mullvad wireguard.sys IOCTL AdapterState reference count
Low 2.3
In plain English
A low-severity security flaw in wireguard.sys from Mullvad. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)2.3Low
Exploit odds (30 days)0.2%top 93.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mullvad | wireguard.sys | 0.10.1 |
Weakness: CWE-911, CWE-664 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-387273 | Mullvad wireguard.sys IOCTL AdapterState reference count vdb-entry, technical-description
- VDB-387273 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-19380 | CVE Analysis and Report third-party-advisory
- Submit #866726 | Mullvad wireguard.sys 0.10.1 Denial of Service third-party-advisory
- https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing exploit