CVE-2026-58085: FreeBSD WireGuard RCE Vulnerability

CVE-2026-58085 Overview

CVE-2026-58085 affects the FreeBSD wg(4) WireGuard kernel driver. The driver dispatches decrypt operations to the OpenBSD Cryptographic Framework (OCF) but fails to check whether the Message Authentication Code (MAC) verification step succeeded. As a result, the driver silently accepts packets carrying an invalid Poly1305 authentication tag. This defect maps to [CWE-347: Improper Verification of Cryptographic Signature].

Critical Impact
A remote attacker who can send UDP packets to a WireGuard endpoint, or intercept packets bound for a FreeBSD host, can inject forged transport data or modify ciphertext and authenticated data without detection.

Affected Products

FreeBSD operating system versions shipping the if_wg (wg(4)) kernel driver
FreeBSD hosts acting as WireGuard tunnel endpoints
Systems using the OpenBSD Cryptographic Framework (OCF) with wg(4) for packet decryption

Discovery Timeline

2026-08-19 - CVE-2026-58085 published to NVD
2026-08-19 - Last updated in NVD database
Advisory - Published as FreeBSD Security Advisory SA-26:52

Technical Details for CVE-2026-58085

Vulnerability Analysis

WireGuard uses the ChaCha20-Poly1305 Authenticated Encryption with Associated Data (AEAD) construction to protect transport data packets. Poly1305 produces a 16-byte MAC that the receiver must verify before trusting the plaintext. In wg(4), the driver offloads this decrypt-and-verify operation to OCF. The bug is that after OCF completes, the driver ignores the verification result. Packets with invalid Poly1305 tags therefore progress through the tunnel as if they were authentic.

The protocol-level defense that normally blunts blind injection is the anti-replay window. An attacker who can guess the current bounds of the receiver's replay counter can craft packets that fall inside the window and be accepted. A network-positioned attacker who can intercept legitimate ciphertext can also modify the ciphertext or associated data in transit, and the receiver will not detect the tampering.

Root Cause

The root cause is a missing return-value check on the OCF decrypt callback path. The wg(4) driver treats completion of the crypto operation as success, without inspecting the flag that indicates MAC validation status. This eliminates the integrity guarantee that ChaCha20-Poly1305 is supposed to provide.

Attack Vector

Exploitation requires the ability to deliver UDP datagrams to the WireGuard listening port on the FreeBSD host, or to sit on-path between two peers. The remote injection scenario also requires the attacker to estimate the receiver's replay window position. Once inside the window, forged transport packets are decrypted and delivered to the tunnel interface as valid inner traffic. See the FreeBSD Security Advisory SA-26:52 for full technical detail.

Detection Methods for CVE-2026-58085

Indicators of Compromise

Unexpected inner-tunnel traffic on wg interfaces that does not correlate with any legitimate peer session
Anomalous jumps in the WireGuard receive counter or replay window without matching sender-side activity
Inner IP packets arriving via wg0 from source addresses that peers should not be able to use

Detection Strategies

Compare per-peer send and receive packet counters between endpoints to detect asymmetric injection
Log and alert on inner-tunnel traffic that violates expected routing or access-control policies inside the VPN
Monitor kernel logs and OCF telemetry for decrypt operations that complete without corresponding upper-layer sessions

Monitoring Recommendations

Capture pre-tunnel UDP traffic on the WireGuard port and correlate with post-tunnel inner traffic for baseline deviation
Enable flow logging on FreeBSD hosts acting as WireGuard concentrators and forward to a centralized SIEM
Alert on unexpected peer handshake reinitiations, which may indicate active manipulation of the session

How to Mitigate CVE-2026-58085

Immediate Actions Required

Apply the patch from FreeBSD Security Advisory SA-26:52 to all FreeBSD hosts running wg(4)
Inventory FreeBSD systems configured as WireGuard endpoints, including appliances and virtual machines derived from FreeBSD
Rotate WireGuard peer keys on affected hosts if injection or tampering is suspected

Patch Information

FreeBSD has issued Security Advisory SA-26:52 covering the if_wg driver. Administrators should upgrade to the fixed FreeBSD release or apply the source patch, then rebuild and reload the if_wg kernel module. Consult the advisory for the exact revision identifiers and supported release branches.

Workarounds

Restrict UDP access to the WireGuard listening port using host and network firewalls, limiting reachable peers to known source addresses
Terminate WireGuard tunnels on a non-FreeBSD platform, or use the userspace wireguard-go implementation, until the patch is applied
Enforce strict inner-tunnel access control so that injected packets cannot reach sensitive services even if they bypass MAC verification

bash

# Configuration example: restrict WireGuard UDP port to known peers with pf
# /etc/pf.conf
wg_port = "51820"
table <wg_peers> persist { 203.0.113.10, 198.51.100.25 }
block in quick on egress proto udp to any port $wg_port
pass  in quick on egress proto udp from <wg_peers> to any port $wg_port