CVE-2023-35838Disclosure(microsoft / windows)

In the past 4 years (2022–2026), the only notable WireGuard-related CVE is CVE-2023-35838: a medium-severity (5.7) issue in the Windows client (v0.5.3) where firewall config could block non-RFC1918 local traffic, potentially allowing an adversary to disrupt access while VPN is on. No critical RCEs, protocol flaws, or high-severity vulns in the core WireGuard codebase. The project’s tiny, audited design means it’s been stable—no major updates needed. “Sleeping” on it isn’t ignoring risks; it’s because none materialized requiring urgent patches. For mature crypto software, this aligns with best practice: update when there’s a real issue, not on a clock. The dev’s hypothetical worry is valid for future scenarios, though.

Do you really have to ask so primitively like this is some random toy app and not a security critical VPN tool that sat completely dead for over four years with zero updates? Fine. There was CVE-2023-35838 in the old 0.5.3 version. The firewall rules were set up like shit and let an attacker on the local network force your machine to block local traffic even when the VPN was fully running. Not exactly a great look for a VPN right? There was also CVE-2021-46873 where someone could fuck with the system time and permanently kill your static private keys. But honestly the CVEs are the smallest part of it. The real issue is four straight years of total neglect. No compatibility fixes for new Windows versions (a ton of people were screwed on 11 24H2), no Go runtime security bumps, no performance or MTU improvements nothing at all even though all that work was sitting ready in the repo the whole time.