Search
Find a vulnerability
Search criteria
5 vulnerabilities by Wireguard
GCVE-1988-2026-0005
Vulnerability from gna-1988 – Published: 2026-09-07 06:42 – Updated: 2026-09-09 10:09
VLAI
EPSS
VEX
Title
WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf
Summary
*Description:*
A stack-based buffer overflow exists in the Linux Industrial I/O (IIO)
userspace utility lsiio. The vulnerability occurs in the
find_type_by_name() function, where the program reads an unbounded string
from a filesystem-backed attribute into a fixed-size stack buffer using
fscanf("%s", ...).
If a crafted or oversized attribute value is present, the unbounded read
causes a write beyond the bounds of the destination stack buffer, resulting
in stack memory corruption.
*Affected Component:*
- Project: Linux kernel userspace tools
- Component: tools/iio/lsiio
- Source file: tools/iio/iio_utils.c (compiled via iio_utils-in.c)
- Function: find_type_by_name()
*Attack Vector:*
- Local
- An attacker who can influence the contents of the filesystem
attributes read by lsiio (e.g., via a crafted sysfs-like directory or
malicious environment) can trigger the overflow.
*Vulnerable Code:*
The vulnerable code performs an unbounded string read:
char name[IIO_MAX_NAME_LENGTH];
...
fscanf(namefp, "%s", name);
*Impact:*
Denial of Service: The application crashes reliably due to stack corruption.
Memory Corruption: Stack memory is overwritten, which may be exploitable
depending on build configuration, compiler protections, and runtime
environment. Although the issue is triggered locally, lsiio is shipped with
multiple Linux distributions as part of kernel userspace tooling, and the
vulnerable code executes prior to any bounds validation.
*Proof of Concept:*
# python3 -c 'print("A" * 4096)' > /tmp/iio/devices/iio:device0/name
# wc -c /tmp/iio/devices/iio:device0/name
4097 /tmp/iio/devices/iio:device0/name
*Output:*
# ./lsiio
=================================================================
==169698==ERROR: AddressSanitizer: stack-buffer-overflow on address
0xfbff91900060 at pc 0xaaaabaf3fb10 bp 0xfffff130c8d0 sp 0xfffff130c0a8
WRITE of size 4097 at 0xfbff91900060 thread T0
#0 0xaaaabaf3fb0c (/root/wireguard-linux/tools/iio/lsiio+0x5fb0c)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#1 0xaaaabaf40a04 (/root/wireguard-linux/tools/iio/lsiio+0x60a04)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#2 0xaaaabb00d3d4 (/root/wireguard-linux/tools/iio/lsiio+0x12d3d4)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#3 0xaaaabb002b04 (/root/wireguard-linux/tools/iio/lsiio+0x122b04)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#4 0xaaaabb0021fc (/root/wireguard-linux/tools/iio/lsiio+0x1221fc)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#5 0xaaaabb001ec0 (/root/wireguard-linux/tools/iio/lsiio+0x121ec0)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
#6 0xffff93982598 (/lib/aarch64-linux-gnu/libc.so.6+0x22598) (BuildId:
7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)
#7 0xffff93982678 (/lib/aarch64-linux-gnu/libc.so.6+0x22678) (BuildId:
7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)
#8 0xaaaabaf1b26c (/root/wireguard-linux/tools/iio/lsiio+0x3b26c)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
Address 0xfbff91900060 is located in stack of thread T0 at offset 96 in
frame
#0 0xaaaabb0027b0 (/root/wireguard-linux/tools/iio/lsiio+0x1227b0)
(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure • Proof-of-Concept Development
🌐 https://github.com/ob1sec
🔗 https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Wireguard | WireGuard-Linux Stack-Based Buffer |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "WireGuard-Linux Stack-Based Buffer",
"vendor": "Wireguard",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "*Description:*\nA stack-based buffer overflow exists in the Linux Industrial I/O (IIO)\nuserspace utility lsiio. The vulnerability occurs in the\nfind_type_by_name() function, where the program reads an unbounded string\nfrom a filesystem-backed attribute into a fixed-size stack buffer using\nfscanf(\"%s\", ...).\nIf a crafted or oversized attribute value is present, the unbounded read\ncauses a write beyond the bounds of the destination stack buffer, resulting\nin stack memory corruption.\n\n*Affected Component:*\n\n - Project: Linux kernel userspace tools\n - Component: tools/iio/lsiio\n - Source file: tools/iio/iio_utils.c (compiled via iio_utils-in.c)\n - Function: find_type_by_name()\n\n\n*Attack Vector:*\n\n - Local\n - An attacker who can influence the contents of the filesystem\n attributes read by lsiio (e.g., via a crafted sysfs-like directory or\n malicious environment) can trigger the overflow.\n\n\n*Vulnerable Code:*\nThe vulnerable code performs an unbounded string read:\nchar name[IIO_MAX_NAME_LENGTH];\n...\nfscanf(namefp, \"%s\", name);\n\n*Impact:*\nDenial of Service: The application crashes reliably due to stack corruption.\nMemory Corruption: Stack memory is overwritten, which may be exploitable\ndepending on build configuration, compiler protections, and runtime\nenvironment. Although the issue is triggered locally, lsiio is shipped with\nmultiple Linux distributions as part of kernel userspace tooling, and the\nvulnerable code executes prior to any bounds validation.\n\n*Proof of Concept:*\n# python3 -c \u0027print(\"A\" * 4096)\u0027 \u003e /tmp/iio/devices/iio:device0/name\n# wc -c /tmp/iio/devices/iio:device0/name\n4097 /tmp/iio/devices/iio:device0/name\n\n*Output:*\n\n# ./lsiio\n=================================================================\n==169698==ERROR: AddressSanitizer: stack-buffer-overflow on address\n0xfbff91900060 at pc 0xaaaabaf3fb10 bp 0xfffff130c8d0 sp 0xfffff130c0a8\nWRITE of size 4097 at 0xfbff91900060 thread T0\n #0 0xaaaabaf3fb0c (/root/wireguard-linux/tools/iio/lsiio+0x5fb0c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #1 0xaaaabaf40a04 (/root/wireguard-linux/tools/iio/lsiio+0x60a04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #2 0xaaaabb00d3d4 (/root/wireguard-linux/tools/iio/lsiio+0x12d3d4)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #3 0xaaaabb002b04 (/root/wireguard-linux/tools/iio/lsiio+0x122b04)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #4 0xaaaabb0021fc (/root/wireguard-linux/tools/iio/lsiio+0x1221fc)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #5 0xaaaabb001ec0 (/root/wireguard-linux/tools/iio/lsiio+0x121ec0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n #6 0xffff93982598 (/lib/aarch64-linux-gnu/libc.so.6+0x22598) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n #7 0xffff93982678 (/lib/aarch64-linux-gnu/libc.so.6+0x22678) (BuildId:\n7544444e7eeafbb5a7ecaf94fc3ebebd2b986846)\n #8 0xaaaabaf1b26c (/root/wireguard-linux/tools/iio/lsiio+0x3b26c)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nAddress 0xfbff91900060 is located in stack of thread T0 at offset 96 in\nframe\n #0 0xaaaabb0027b0 (/root/wireguard-linux/tools/iio/lsiio+0x1227b0)\n(BuildId: 6e2b994e1a38e5b227745ec0d1360f58d96f0846)\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:09:50Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/17"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/17"
],
"discovery": "EXTERNAL"
},
"title": "WireGuard-Linux Stack-Based Buffer Overflow in lsiio (Linux IIO Userspace Tool) Due to Unbounded fscanf",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0005",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/17",
"automated": true,
"contentSha256": "e8715268b91f48cad7e419ae73ffd61eafc139f3587a7f13ebbd0c40ca39b999",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/17",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-30T23:49:32Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:42:13Z",
"dateUpdated": "2026-09-09T10:09:50Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0005"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-35838 (GCVE-0-2023-35838)
Vulnerability from nvd – Published: 2023-08-09 00:00 – Updated: 2024-10-18 19:02
VLAI
EPSS
VEX
Summary
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 19:01 UTC
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://wireguard.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://tunnelcrack.mathyvanhoef.com/details.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T19:01:55.378972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T19:02:08.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to \"LocalNet attack resulting in the blocking of traffic\" rather than to only WireGuard."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-31T08:06:29.358Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://wireguard.com"
},
{
"url": "https://tunnelcrack.mathyvanhoef.com/details.html"
},
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35838",
"datePublished": "2023-08-09T00:00:00.000Z",
"dateReserved": "2023-06-18T00:00:00.000Z",
"dateUpdated": "2024-10-18T19:02:08.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-46873 (GCVE-0-2021-46873)
Vulnerability from nvd – Published: 2023-01-29 00:00 – Updated: 2025-03-28 15:47
VLAI
EPSS
VEX
Summary
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-28 15:47 UTC
CWE
- n/a
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:17:42.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-46873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-28T15:47:10.741218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T15:47:37.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim\u0027s system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-29T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-46873",
"datePublished": "2023-01-29T00:00:00.000Z",
"dateReserved": "2023-01-29T00:00:00.000Z",
"dateUpdated": "2025-03-28T15:47:37.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-35838 (GCVE-0-2023-35838)
Vulnerability from cvelistv5 – Published: 2023-08-09 00:00 – Updated: 2024-10-18 19:02
VLAI
EPSS
VEX
Summary
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "LocalNet attack resulting in the blocking of traffic" rather than to only WireGuard.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-18 19:01 UTC
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T16:30:45.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://wireguard.com"
},
{
"tags": [
"x_transferred"
],
"url": "https://tunnelcrack.mathyvanhoef.com/details.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-35838",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-18T19:01:55.378972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-18T19:02:08.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. This allows an adversary to trick the victim into blocking IP traffic to selected IP addresses and services even while the VPN is enabled. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to \"LocalNet attack resulting in the blocking of traffic\" rather than to only WireGuard."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-31T08:06:29.358Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://wireguard.com"
},
{
"url": "https://tunnelcrack.mathyvanhoef.com/details.html"
},
{
"url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2023-0015"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-35838",
"datePublished": "2023-08-09T00:00:00.000Z",
"dateReserved": "2023-06-18T00:00:00.000Z",
"dateUpdated": "2024-10-18T19:02:08.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-46873 (GCVE-0-2021-46873)
Vulnerability from cvelistv5 – Published: 2023-01-29 00:00 – Updated: 2025-03-28 15:47
VLAI
EPSS
VEX
Summary
WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-28 15:47 UTC
CWE
- n/a
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T05:17:42.653Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2021-46873",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-28T15:47:10.741218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-28T15:47:37.955Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim\u0027s system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-29T00:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://lists.zx2c4.com/pipermail/wireguard/2021-August/006916.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-46873",
"datePublished": "2023-01-29T00:00:00.000Z",
"dateReserved": "2023-01-29T00:00:00.000Z",
"dateUpdated": "2025-03-28T15:47:37.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}