WireGuard VPN Vulnerability in Zephyr Affecting Data Integrity

CVE-2026-13734

What is CVE-2026-13734?

The vulnerability in WireGuard's implementation in Zephyr allows attackers to perform replay attacks due to improper timing in the anti-replay counter validation. The handler processes received packets and updates peer states before checking for replay conditions, potentially leading to traffic redirection, session disruptions, and unauthorized access to the victim's tunnel traffic. The issue arises when an attacker captures valid packets and re-injects them, taking advantage of the state mutations that occur before replay checks are applied. The vulnerability has been addressed by ensuring that the replay check occurs immediately after decryption, preventing state changes on replayed packets.

References