WireGuard VPN Service Vulnerability in Peer Endpoint Handling

CVE-2026-79977

What is CVE-2026-79977?

A vulnerability exists in the WireGuard VPN service where the peer endpoint can be updated from an unauthenticated message. When an incoming transport-data message is received, if the receiver index does not match a session, the code executes an unauthorized endpoint update. This allows an attacker who can send UDP datagrams to the service to spoof the peer's endpoint, redirecting legitimate traffic to a malicious address. Consequently, the legitimate peer cannot re-initiate a handshake, leading to potential denial of service. While WireGuard's end-to-end encryption protects the content from being compromised, the vulnerability primarily affects availability and confidentiality, as attackers can intercept initial handshakes and relay them to the legitimate peer. The issue has been addressed by ensuring that updates to the endpoint are only made from authenticated messages, thereby enhancing the security of the WireGuard VPN service.

References