CVE-2026-58085: After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the…
CVE-2026-58085 · Severity: high · CVSS 7.5 · Published 2026-08-19
After dispatching a decrypt operation to OCF and receiving the result, the wg(4) driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag.
A remote attacker who can send UDP packets to a WireGuard endpoint, and who can guess the bounds of the receiver's replay window, can inject forged or modified transport data packets into the tunnel.
A remote attacker who can intercept WireGuard packets bound for a FreeBSD host can modify the ciphertext and authenticated data without detection by the receiver.
No. Junglewise Threat Intelligence has no report of CVE-2026-58085 being exploited in the wild.
How severe is CVE-2026-58085?
High severity, with a CVSS score of 7.5, published 19 August 2026.
Which products and versions are affected?
Freebsd. The advisory does not name versions.
Is there a fix for CVE-2026-58085?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2026-58085?
Check whether you run Freebsd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.