🚨 HIGH - Zephyr WireGuard out-of-bounds write in wg_process_data_message() (CVE-2026-10665) Zephyr RTOS’s WireGuard subsystem is vulnerable in wg_process_data_message(), where an attacker-controlled data_len is incorrectly used when linearizing a UDP transport-data packet prior to decryption. The root cause is an out-of-bounds write due to improper bounds checking and misuse of data_len as both the destination capacity and the copy length. A malicious/compromised WireGuard peer or an on-path attacker can exploit this by sending oversized UDP transport-data payloads that exceed CONFIG_WIREGUARD_BUF_LEN to trigger memory corruption. Real-world impact includes reliable denial of service and potential further exploitation depending on the target’s memory layout and protections. 👉 Affected: zephyr 4.4.0 | Upgrade to 4.4.1
Post summary
This advisory discloses a high‑severity out‑of‑bounds write flaw in Zephyr WireGuard’s wg_process_data_message() (CVE‑2026‑10665) and recommends upgrading to version 4.4.1 for remediation.
