WireGuard Vulnerability in Zephyr's Network System

CVE-2026-13735

What is CVE-2026-13735?

Zephyr's WireGuard implementation has a vulnerability related to the mishandling of keepalive packets. Specifically, a type-4 transport-data message with a precise 16-byte payload can be accepted without performing the necessary decryption and authentication checks. This occurs when malicious actors send a crafted keepalive packet, exploiting the absence of Poly1305 tag verification. The attack can be facilitated by cleartext transmission of receiver indices, allowing both active and passive adversaries to transmit unauthorized messages. While the vulnerability does not compromise the confidentiality of the session or allow traffic injection, it undermines the integrity of system notifications, such as the NET_EVENT_VPN_CONNECTED signal. The remedy involves altering the processing path to ensure all packets, including those that seem legitimate, undergo proper decryption and validation before acceptance.

References