CVE-2026-13734 in Zephyr
Summary
by MITRE • 08/29/2026
Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back.
The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c.
Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/29/2026
The vulnerability in Zephyr's WireGuard VPN implementation stems from an incorrect ordering of operations within the data-plane receive handler function wg_process_data_message located in subsys/net/lib/wireguard/wg_crypto.c. This flaw represents a critical logic error where anti-replay validation is performed after state mutations have already been committed to memory, rather than before them as required by cryptographic best practices and the WireGuard specification itself. The sequence of operations begins with the decryption of an incoming MESSAGE_TRANSPORT_DATA packet using Authenticated Encryption with Associated Data (AEAD). Because AEAD algorithms provide integrity but not freshness guarantees, a valid ciphertext will decrypt successfully even if it is a duplicate or replayed message from a previous session window. Upon successful decryption, the code proceeds to update peer state variables including endpoint addresses via update_peer_addr(), refreshes liveness timers such as keypair->last_rx and peer->last_rx, and executes keypair_update() which promotes the next keypair to current status while destroying the previous one. Only after these irreversible changes are applied does the system invoke wg_check_replay(). When a replayed packet is detected at this late stage, the function returns an error code indicating invalid input, but because the state mutations have already occurred, they remain in effect despite the rejection of the message payload.
This architectural flaw allows for significant operational impacts including roaming hijacking and session disruption without requiring any authentication credentials from the attacker. An adversary positioned on-path or operating within a shared network medium can capture a single valid ciphertext transmitted between legitimate peers. By re-injecting this captured packet with a spoofed source address, the attacker exploits the race condition inherent in the flawed logic. The victim's WireGuard peer will accept the decrypted content and update its internal state to reflect the new endpoint address provided by the spoofed packet. This effectively redirects all subsequent outbound tunnel traffic destined for that peer toward the attacker-controlled IP address until a legitimate packet from the original source arrives and corrects the routing information. Additionally, the premature destruction of the previous keypair forces an unnecessary cryptographic re-keying process, while the refreshment of liveness timers may keep connections alive longer than intended or mask disconnection events depending on timing interactions with other network conditions.
From a security classification perspective, this vulnerability aligns closely with CWE-367 which describes Time-of-check to time-of-use (TOCTOU) race conditions where the state is modified between verification and usage. It also relates to CWE-20 Improper Input Validation as the system fails to validate input integrity before processing it. In terms of attack patterns, this behavior corresponds to MITRE ATT&CK technique T1498 Network Denial of Service specifically through resource exhaustion or disruption via state manipulation, although in this context it is more accurately characterized by traffic redirection capabilities similar to aspects of BGP hijacking but at the application layer protocol level. The impact is primarily categorized as integrity and availability compromise rather than confidentiality breach since the tunnel payload remains encrypted under the existing session keys during the attack window.
The resolution involves reordering the execution flow within wg_process_data_message so that wg_check_replay() is called immediately following successful AEAD decryption but prior to any peer-state mutations such as endpoint updates, timer refreshes, or keypair rotations. This adjustment ensures compliance with the WireGuard specification and aligns Zephyr's implementation with the Linux reference kernel module which correctly validates packet freshness before applying state changes. Implementing this fix prevents replayed packets from causing unintended side effects in peer configuration while maintaining the performance benefits of deferred validation where appropriate for other non-security-critical operations. System administrators should ensure their deployments are updated to versions containing this patch and monitor for unusual endpoint address changes or unexpected keypair rotations that might indicate exploitation attempts against unpatched systems.