{"id":"CVE-2026-19380","state":"PUBLISHED","title":"Mullvad wireguard.sys IOCTL AdapterState reference count","description":"A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.","publishedAt":"2026-08-10T00:15:09.720Z","updatedAt":"2026-08-10T21:11:32.494Z","severity":{"score":4.6,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Mullvad wireguard.sys"],"affected":[{"vendor":"Mullvad","product":"wireguard.sys","versions":[{"version":"0.10.1","status":"affected"}],"cpes":["cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:*"],"modules":["IOCTL Handler"]}],"references":["https://vuldb.com/vuln/387273","https://vuldb.com/vuln/387273/cti","https://vuldb.com/cve/CVE-2026-19380","https://vuldb.com/submit/866726","https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing"],"weaknesses":["CWE-911","CWE-664"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19380.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19380","state":"PUBLISHED","datePublished":"2026-08-10T00:15:09.720Z","dateUpdated":"2026-08-10T21:11:32.494Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-08-09T15:13:18.154Z"},"containers":{"cna":{"title":"Mullvad wireguard.sys IOCTL AdapterState reference count","descriptions":[{"lang":"en","value":"A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure."}],"affected":[{"vendor":"Mullvad","product":"wireguard.sys","versions":[{"version":"0.10.1","status":"affected"}],"cpes":["cpe:2.3:a:mullvad:wireguard.sys:*:*:*:*:*:*:*:*"],"modules":["IOCTL Handler"]}],"references":[{"url":"https://vuldb.com/vuln/387273","name":"VDB-387273 | Mullvad wireguard.sys IOCTL AdapterState reference count","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/387273/cti","name":"VDB-387273 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/cve/CVE-2026-19380","name":"CVE-2026-19380 | CVE Analysis and Report","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/866726","name":"Submit #866726 | Mullvad wireguard.sys 0.10.1 Denial of Service","tags":["third-party-advisory"]},{"url":"https://drive.google.com/file/d/1LN68wxIx_2EI4IBVq13UlP4G1aqyz--x/view?usp=sharing","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":4.6,"vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":2.3,"vectorString":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV3_0":{"version":"3.0","baseScore":2.3,"vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"LOW"}},{"cvssV2_0":{"version":"2.0","baseScore":1.4,"vectorString":"AV:L/AC:L/Au:M/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-911","type":"CWE","lang":"en","description":"Improper Update of Reference Count"}]},{"descriptions":[{"cweId":"CWE-664","type":"CWE","lang":"en","description":"Improper Control of Resource Through Lifetime"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-08-10T00:15:09.720Z"},"timeline":[{"time":"2026-08-09T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-08-09T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-08-09T17:18:23.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Raulisr00t (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}],"x_generator":["VulDB PVTS v202608"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-10T19:16:20.509820Z","id":"CVE-2026-19380","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-10T21:11:32.494Z"}}]}}}