Search
Find a vulnerability
Search criteria
2 vulnerabilities found for wireguard.sys by Mullvad
CVE-2026-19380 (GCVE-0-2026-19380)
Vulnerability from nvd – Published: 2026-08-10 00:15 – Updated: 2026-08-10 21:11
VLAI
EPSS
VEX
Title
Mullvad wireguard.sys IOCTL AdapterState reference count
Summary
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 19:16 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387273 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387273/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19380 | third-party-advisory |
| https://vuldb.com/submit/866726 | third-party-advisory |
| https://drive.google.com/file/d/1LN68wxIx_2EI4IBV… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mullvad | wireguard.sys |
Affected:
0.10.1
cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19380",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T19:16:20.509820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:11:32.494Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:*"
],
"modules": [
"IOCTL Handler"
],
"product": "wireguard.sys",
"vendor": "Mullvad",
"versions": [
{
"status": "affected",
"version": "0.10.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Raulisr00t (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.4,
"vectorString": "AV:L/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-911",
"description": "Improper Update of Reference Count",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "Improper Control of Resource Through Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T00:15:09.720Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387273 | Mullvad wireguard.sys IOCTL AdapterState reference count",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387273"
},
{
"name": "VDB-387273 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387273/cti"
},
{
"name": "CVE-2026-19380 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19380"
},
{
"name": "Submit #866726 | Mullvad wireguard.sys 0.10.1 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/866726"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-09T17:18:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mullvad wireguard.sys IOCTL AdapterState reference count",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19380",
"datePublished": "2026-08-10T00:15:09.720Z",
"dateReserved": "2026-08-09T15:13:18.154Z",
"dateUpdated": "2026-08-10T21:11:32.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19380 (GCVE-0-2026-19380)
Vulnerability from cvelistv5 – Published: 2026-08-10 00:15 – Updated: 2026-08-10 21:11
VLAI
EPSS
VEX
Title
Mullvad wireguard.sys IOCTL AdapterState reference count
Summary
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 19:16 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/387273 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/387273/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-19380 | third-party-advisory |
| https://vuldb.com/submit/866726 | third-party-advisory |
| https://drive.google.com/file/d/1LN68wxIx_2EI4IBV… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Mullvad | wireguard.sys |
Affected:
0.10.1
cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19380",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T19:16:20.509820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:11:32.494Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:*"
],
"modules": [
"IOCTL Handler"
],
"product": "wireguard.sys",
"vendor": "Mullvad",
"versions": [
{
"status": "affected",
"version": "0.10.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Raulisr00t (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 1.4,
"vectorString": "AV:L/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-911",
"description": "Improper Update of Reference Count",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-664",
"description": "Improper Control of Resource Through Lifetime",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T00:15:09.720Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-387273 | Mullvad wireguard.sys IOCTL AdapterState reference count",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/387273"
},
{
"name": "VDB-387273 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/387273/cti"
},
{
"name": "CVE-2026-19380 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-19380"
},
{
"name": "Submit #866726 | Mullvad wireguard.sys 0.10.1 Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/866726"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-09T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-08-09T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-08-09T17:18:23.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mullvad wireguard.sys IOCTL AdapterState reference count",
"x_generator": [
"VulDB PVTS v202608"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-19380",
"datePublished": "2026-08-10T00:15:09.720Z",
"dateReserved": "2026-08-09T15:13:18.154Z",
"dateUpdated": "2026-08-10T21:11:32.494Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}