CVE-2026-19380
Received
Received - Intake
Improper Reference Count Update in Mullvad WireGuard Driver
Vulnerability report for CVE-2026-19380, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-10
Last updated on: 2026-08-10
Assigner: VulDB
Description
Description
A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mullvad | wireguard | 0.10.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-664 | The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release. |
| CWE-911 | The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. |
