Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-58085— Missing MAC validation in wg(4) packet decryption

Quick assessment

Affected

FreeBSD FreeBSD

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在将解密操作分发到 OCF（Open Crypto Framework，开放加密框架）并接收结果后，wg(4) 驱动程序未能检查 MAC（消息认证码）验证步骤是否成功。因此，该驱动程序默许了携带无效 Poly1305 认证标签的数据包。若远程攻击者能够向 WireGuard 端点发送 UDP 数据包，并且能够推测出接收方重放窗口（replay window）的边界，则可以向隧道中注入伪造或篡改的传输数据数据包。若远程攻击者能够拦截发往 FreeBSD 主机的 WireGuard 数据包，则可以在不被接收方检测到

AI Predicted 7.5 Difficulty: Easy EPSS 0.14% · P4 Updated Aug 19, 2026

Possible ATT&CK Techniques 2 AI

T1557 · Adversary-in-the-Middle T1557.001 · Name Resolution Poisoning and SMB Relay

Affected Version Matrix 3

Vendor	Product	Version Range	Status
FreeBSD	FreeBSD	`15.1-RELEASE< p2`	affected
		`15.0-RELEASE< p12`	affected
		`14.4-RELEASE< p8`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Missing MAC validation in wg(4) packet decryption

Source: CVE Program / CVE List V5

Vulnerability Description

After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel. A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

密码学签名的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FreeBSD	FreeBSD	15.1-RELEASE ~ p2	-

II. Public POCs for CVE-2026-58085

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-58085

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-58085 (1)

🔗 https://security.freebsd.org/advisories/FreeBSD-SA-26:52.if_wg.asc Read full article vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-58085

Same Patch Batch · FreeBSD · 2026-08-19 · 23 CVEs total

CVE-2026-49426		Incorrect audit records for ptrace(2) syscall requests
CVE-2026-58087		Heap out-of-bounds access in semctl(2)
CVE-2026-58088		Race condition in ELF core dump segment counting
CVE-2026-58083		Use-after-free in kqueue copy-on-fork
CVE-2026-58084		Kernel stack disclosure via timer_settime(2)
CVE-2026-58086		ktrace(2) privilege incorrectly validated in jails
CVE-2026-49425		Kernel stack disclosure in 32-bit compatibility support
CVE-2026-49424		Kernel stack disclosure in Linux compatibility layer
CVE-2026-58081		Heap based buffer overflow in iconv(3)
CVE-2026-58082		Stack based buffer overflow in iconv(3)
CVE-2026-49423		Remote DOS via uninitialized memory access in KTLS receive
CVE-2026-49418		Use-after-free in device pager page list
CVE-2026-49427		posixshm: largepage shared memory objects not explicitly wired
CVE-2026-49428		posixshm: system calls can incorrectly free memory of largepage objects
CVE-2026-49420		Buffer overflow in libalias RTSP handler
CVE-2026-49422		Use-after-free in TCP RACK stack option handler
CVE-2026-49421		unlinkat(2) ignores AT_RESOLVE_BENEATH flag
CVE-2026-49430		Kernel heap overflow in ZFS_IOC_RECV_NEW ioctl
CVE-2026-49429		Kernel heap overflow in ZFS_IOC_USERSPACE_MANY ioctl
CVE-2026-49431		Incorrect user validation in ZFS_IOC_SET_PROP ioctl

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: FreeBSD

Same vendor: FreeBSD

Same weakness: CWE-347

V. Comments for CVE-2026-58085

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-58085— Missing MAC validation in wg(4) packet decryption

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 3

I. Basic Information for CVE-2026-58085

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-58085

III. Intelligence Information for CVE-2026-58085

Vendor Advisories for CVE-2026-58085 (1)

Same Patch Batch · FreeBSD · 2026-08-19 · 23 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-58085

Leave a comment