Insufficient verification of data authenticity in FreeBSD - CVE-2026-58085
Published: July 29, 2026 / Updated: July 30, 2026
Vulnerability identifier: #VU140491
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-58085
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
FreeBSD
FreeBSD
Detailed vulnerability description
The vulnerability allows a remote attacker to inject forged or modified transport data packets into the tunnel.
The vulnerability exists due to improper authentication in wg(4) packet decryption when processing WireGuard data packets through the OpenCrypto framework. A remote attacker can send specially crafted UDP packets or modify intercepted WireGuard packets to inject forged or modified transport data packets into the tunnel.
Exploitation requires the ability to send packets to a WireGuard endpoint and to guess the bounds of the receiver's replay window, or to intercept WireGuard packets bound for the host.
How to mitigate CVE-2026-58085
Install security update from vendor's website.