wireguard freebsd wg(4) CVE-2026-58085

[wirehire]

a new cve for freebsd wireguard was found :

https://www.freebsd.org/security/advisories/FreeBSD-SA-26:52.if_wg.asc

Greets!

[paepcke]

https://www.tenable.com/cve/CVE-2026-58085



CVSS v3 : Base Score: 7.5 (HIGH)

Its a big one!

(Failure to check inbound data authentication!)

Quick hotfix & backports would be very welcome. Very small patch, very big impact. Expect AI assisted exploit flood in 3...2...1 ...

[userfw]

It's a vulnerability that defeats the purpose of a VPN.

[paepcke]

fixed, scheduled for 26.7.2 & 26.4.1p3

https://github.com/opnsense/src/pull/313

https://github.com/opnsense/core/issues/10650

[paepcke]

It's a vulnerability that defeats the purpose of a VPN.

To clear, this bug does only impact the data *authentication* check of the stream cipher on data inbound side -  not the data *encryption* itself!

This bug does NOT leaked direct any information or allowed to manipulate any information without breaking the private / session key first.

This bug (or bug-door) allowed to trick the server to process (parse) unauthenticated data.

Thats bad! But to exploit this, at least some weeks ago, some nation-state-actor level know-how was needed.

With the now publicly accessible open weight ai models it's direct, one shot and reliable reproduce able, possible for *everyone* to directly identify this bug - including a detailed report about the complete implications further down the process chain ...

So, yes. Patch and back port. NOW!