Vulnerability · Published Aug 19, 2026 · Assigned by freebsd

CVE-2026-58085Missing MAC validation in wg(4) packet decryption

High 7.5

In plain English

A high-severity security flaw in FreeBSD from FreeBSD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 74.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel. A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.

Affected products (as reported)

Vendor	Product	Versions
FreeBSD	FreeBSD	15.1-RELEASE – before p215.0-RELEASE – before p1214.4-RELEASE – before p8

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://security.freebsd.org/advisories/FreeBSD-SA-26:52.if_wg.asc vendor-advisory