CVE-2026-58085 Missing MAC validation in wg(4) packet decryption
Remote attackers can inject or modify WireGuard tunnel data by bypassing MAC validation in the FreeBSD wg(4) driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58085?
CVE-2026-58085 is a high-severity vulnerability in Freebsd Freebsd, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.
A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.
A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.
Weakness: CWE-347
Which versions are affected by CVE-2026-58085?
It affects 1 product.
Products include Freebsd Freebsd.
How do I fix CVE-2026-58085?
No fix has been published for CVE-2026-58085 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-58085 being exploited?
There is no known exploitation of CVE-2026-58085 in the wild and no public exploit code.
Other vulnerabilities in Freebsd Freebsd
Sources
Also known as GHSA-ph3x-qgrx-fv78.