CVE-2026-19380 Overview
CVE-2026-19380 affects Mullvad wireguard.sys version 0.10.1. The vulnerability resides in the AdapterState function within the IOCTL Handler component. Improper update of a reference count [CWE-664] allows a local attacker with high privileges to affect availability of the driver. Public exploit details are available, and the vendor was contacted before disclosure.
Critical Impact
A local, authenticated attacker can trigger a reference count mishandling condition in the WireGuard Windows kernel driver, potentially leading to limited availability impact on the affected host.
Affected Products
- Mullvad wireguard.sys 0.10.1
- Windows systems running the affected WireGuard driver
- Deployments relying on the IOCTL Handler AdapterState function
Discovery Timeline
- 2026-08-10 - CVE-2026-19380 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-19380
Vulnerability Analysis
The flaw exists in the AdapterState function of the IOCTL Handler in Mullvad wireguard.sys 0.10.1. The driver improperly updates a reference count when handling IOCTL requests directed at adapter state operations. Improper reference count management [CWE-664] falls under the broader category of improper control of a resource through its lifetime.
The vulnerability requires local access and high privileges on the target host. It does not require user interaction. The impact is limited to availability of the driver component, with no direct confidentiality or integrity consequences reported. According to the VulDB entry for CVE-2026-19380, public exploit material exists and may be reused by attackers.
Root Cause
The root cause is an improper update of a reference count [CWE-664] within the AdapterState handler. Reference count errors in kernel drivers typically manifest as premature object release, leaked references, or inconsistent object state. Any of these outcomes can destabilize the driver when specific IOCTL sequences are issued from user mode.
Attack Vector
An attacker with local, high-privileged access issues crafted IOCTL requests to the WireGuard driver. The requests target the AdapterState code path, triggering the reference count mismanagement. Successful triggering can degrade driver availability on the affected endpoint. No network path or user interaction is required. Technical detail is described in the VulDB vulnerability record #387273.
No verified proof-of-concept code is included in this article. Refer to the VulDB submission #866726 for reported technical context.
Detection Methods for CVE-2026-19380
Indicators of Compromise
- Unexpected termination, restart, or hang of the wireguard.sys driver on Windows endpoints.
- Anomalous IOCTL activity from user-mode processes targeting the WireGuard adapter device.
- Windows kernel event logs referencing faults in the WireGuard adapter state handling.
Detection Strategies
- Monitor for driver crash events (Event ID 41, bugcheck codes) correlated with WireGuard driver load.
- Baseline expected callers of the WireGuard device object and alert on new or unsigned processes issuing IOCTLs.
- Track integrity of wireguard.sys version 0.10.1 across managed endpoints for inventory purposes.
Monitoring Recommendations
- Enable Windows kernel telemetry and forward driver-related events to a centralized log store for correlation.
- Alert on repeated driver reload cycles that may indicate exploit iteration attempts.
- Correlate process ancestry with IOCTL activity to identify unprivileged callers escalating to driver interaction.
How to Mitigate CVE-2026-19380
Immediate Actions Required
- Inventory endpoints running Mullvad wireguard.sys 0.10.1 and prioritize them for update review.
- Restrict local administrative access on hosts where the driver is installed, since the exploit requires high privileges.
- Monitor vendor channels for a fixed driver release addressing the AdapterState reference count issue.
Patch Information
No vendor patch reference is currently listed in the enriched CVE data. Consult the VulDB CVE-2026-19380 record and Mullvad's official channels for release updates. Apply any released driver update to systems running version 0.10.1 as soon as it becomes available.
Workarounds
- Limit the set of local accounts with administrative privileges on hosts running the affected driver.
- Consider temporarily disabling the WireGuard adapter on non-essential hosts until a fixed driver is available.
- Apply application control policies to restrict which user-mode binaries can open handles to the WireGuard device.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
