{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.4.2","status":"affected","version":"4.4.0","versionType":"semver"}]}],"cveId":"CVE-2026-10665","cwes":["CWE-787"],"description":"In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The call net_buf_linearize(buf->data, data_len, pkt->buffer, ..., data_len) passed the attacker-derived data_len as both the destination capacity and the copy length, defeating the function's internal len = min(len, dst_len) bound. data_len is derived from the received UDP datagram length and is only lower-bounded by wg_ctrl_recv() (no upper bound). When data_len exceeds CONFIG_WIREGUARD_BUF_LEN — e.g. when the buffer length is lowered below the link MTU, on links with MTU above the buffer size, or via reassembled IPv4/IPv6 fragments that exceed it — the underlying memcpy writes past the end of the pool buffer, an out-of-bounds write (CWE-787). The overflow occurs before the Poly1305 authentication check, so it requires only a valid receiver session index rather than a valid authenticator, and is reachable by a malicious or compromised peer (or an on-path attacker driving an established session) over the network, yielding remote memory corruption and at minimum a reliable denial of service. The defect was present in the WireGuard implementation shipped in Zephyr 4.4.0. The fix adds an explicit data_len > CONFIG_WIREGUARD_BUF_LEN rejection and corrects the linearize call to pass net_buf_max_len(buf) as the destination capacity.","epss":{"date":"2026-11-03","percentile":0.48863,"score":0.00602},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3wqm-wgx2-9367"}],"kev":null,"metrics":[{"score":7.4,"severity":"high","source":"CNA: zephyr","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1793768321277,"publishedAt":1783873009648,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/6d8bb28dc9064e05e52b5a00b2998ecc663e38cb"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3wqm-wgx2-9367"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3wqm-wgx2-9367"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/6d8bb28dc9064e05e52b5a00b2998ecc663e38cb"}],"revision":"e37807b9a8b59dcc768f13f0038d0c3880ee931437666aedf7057fe7b5a98cad","sources":[{"modifiedAt":1793768321277,"name":"CNA: zephyr","retrievedAt":1793768927547,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10665"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793768962017,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-10665"}],"ssvc":{"assessedAt":1783957725958,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Heap buffer overflow on WireGuard receive path via unbounded incoming packet length","updatedAt":1793768962017}