CVE-2026-79977 zephyrproject CVE debrief

Who should care

Network administrators and security teams responsible for managing WireGuard VPN services should assess their exposure and verify that their configurations are secure. This includes reviewing and updating configurations to ensure secure endpoint updates, implementing additional monitoring and logging to detect potential exploitation attempts, and verifying that the WireGuard VPN service is running with the latest security patches and updates. Additionally,

Why it matters

The WireGuard VPN service vulnerability allows an attacker to redirect peer endpoint updates, potentially causing a denial-of-service (DoS) and limited confidentiality impact. Network administrators and security teams should assess their exposure and verify that their configurations are secure.

• Potential denial-of-service (DoS) impact due to endpoint redirection.
• Limited confidentiality impact due to potential traffic interception.
• Need for verification of WireGuard VPN service configurations and security patches.
• Potential for traffic metadata exposure.

Technical summary

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. This allows an attacker to redirect peer->endpoint to an address of their choosing, potentially causing a denial-of-service (DoS) and limited confidentiality impact. The vulnerability arises from the service's ability to update the peer endpoint from unauthenticated messages, which can be exploited by sending a spoofed datagram to the WireGuard listener. The fix removes the endpoint learning from this path entirely, and the handshake is sent only to an endpoint learnt from an authenticated message, falling back to the configured cfg_endpoint.

Defensive priority

High

Recommended defensive actions

• Review and update WireGuard VPN service configurations to ensure secure endpoint updates.
• Implement additional monitoring and logging to detect potential exploitation attempts.
• Verify that WireGuard VPN service is running with the latest security patches and updates.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability details are based on the CVE and NVD records, which indicate that the WireGuard VPN service is susceptible to endpoint redirection due to unauthenticated peer updates. The CVE Program and NVD provide official records of this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.