Description

A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.3",
  "pubDate": "2026-08-10T01:16:48.163Z",
  "pubdate": "2026-08-10T01:16:48.163Z",
  "executiveSummary": "A vulnerability has been identified in the Mullvad wireguard.sys driver version 0.10.1, specifically residing within the IOCTL Handler component and the AdapterState function. The root security issue stems from an improper update of reference counts during input/output control processing, which can lead to memory management anomalies. The impact of this vulnerability involves potential local system instability, denial of service, or elevation of privilege depending on the precise exploitation primitive achieved by an adversary. The affected system is limited to Windows environments utilizing the vulnerable Mullvad wireguard.sys kernel driver version 0.10.1. Risk implications are moderate to high due to the kernel-level execution context of the driver. Attacker capabilities require local access to the target host to interact directly with the vulnerable driver interface. Exploitation requirements necessitate that the attacker has already obtained local execution privileges on the underlying operating system to dispatch malicious IOCTL requests to the driver. Publicly available exploit material increases the urgency for remediation, as the barrier to exploitation is significantly lowered.",
  "technicalDetails": "The vulnerability is localized within the wireguard.sys driver, specifically inside the AdapterState function of the IOCTL Handler component in version 0.10.1. The root cause of the security flaw is an improper update of the reference count for internal kernel objects or driver structures when processing specific input/output control requests. Kernel drivers must precisely manage reference counting to ensure objects are not prematurely freed or leaked while still in use. When the AdapterState function fails to correctly increment or decrement the reference count upon handling designated IOCTL codes, it introduces a memory management vulnerability, such as a use-after-free or dangling pointer condition within kernel space.\nExploitation of this vulnerability requires local access to the targeted operating system. An unprivileged or low-privileged local user, or malicious software already executing on the system, can open a handle to the device object exposed by wireguard.sys using standard Windows APIs such as CreateFile. Once a valid handle is established, the attacker crafts and dispatches malicious input buffers using the DeviceIoControl function, targeting the vulnerable IOCTL handler associated with the AdapterState function.\nDuring the processing of the crafted IOCTL payload, the vulnerable function incorrectly handles the reference tracking of the underlying adapter state structures. By triggering race conditions or repeatedly issuing specific control codes, the attacker can force an unbalanced reference count. This anomaly can lead to the premature destruction of kernel memory structures while references to them still exist, resulting in a use-after-free condition. Subsequent operations by the driver on the freed memory region can lead to kernel crashes resulting in a blue screen of death (DoS), or potentially be leveraged by a sophisticated actor to achieve arbitrary kernel code execution and escalate privileges to NT AUTHORITY\\SYSTEM. Network exposure is non-existent as remote exploitation is precluded; the attack vector is strictly local, requiring direct interaction with the kernel driver's device interface."
}