OpenBSD wg(4) kernel crash
Priority LOW 32CWE-131Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.
Summary
In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00446 38th percentileScored 2026-11-07
Fix Fixed OpenBSD (OpenBSD): 7.6 errata 006, 7.6 errata 008, 7.5 errata 015
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenBSD | OpenBSD | 7.6 to before 7.6 errata 006; 7.5 to before 7.5 errata 015 | 7.6 errata 006, 7.6 errata 008, 7.5 errata 015 | Patch available | CNA |
- OpenBSD VendorOpenBSD Affected 7.6 to before 7.6 errata 006; 7.5 to before 7.5 errata 015 Fixed in 7.6 errata 006, 7.6 errata 008, 7.5 errata 015 Patch available CNA
CPE configurations NVD · 22
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* | before 7.5 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:-:*:*:*:*:*:* | 7.5 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_001:*:*:*:*:*:* | 7.5 errata_001 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_002:*:*:*:*:*:* | 7.5 errata_002 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_003:*:*:*:*:*:* | 7.5 errata_003 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_004:*:*:*:*:*:* | 7.5 errata_004 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_005:*:*:*:*:*:* | 7.5 errata_005 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_006:*:*:*:*:*:* | 7.5 errata_006 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_007:*:*:*:*:*:* | 7.5 errata_007 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_008:*:*:*:*:*:* | 7.5 errata_008 | Vulnerable | OpenBSD |
- cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions before 7.5 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:-:*:*:*:*:*:* Versions 7.5 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_001:*:*:*:*:*:* Versions 7.5 errata_001 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_002:*:*:*:*:*:* Versions 7.5 errata_002 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_003:*:*:*:*:*:* Versions 7.5 errata_003 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_004:*:*:*:*:*:* Versions 7.5 errata_004 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_005:*:*:*:*:*:* Versions 7.5 errata_005 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_006:*:*:*:*:*:* Versions 7.5 errata_006 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_007:*:*:*:*:*:* Versions 7.5 errata_007 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_008:*:*:*:*:*:* Versions 7.5 errata_008 Vulnerable ·OpenBSD
Show 12 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:openbsd:openbsd:7.5:errata_009:*:*:*:*:*:* | 7.5 errata_009 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_010:*:*:*:*:*:* | 7.5 errata_010 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_011:*:*:*:*:*:* | 7.5 errata_011 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_012:*:*:*:*:*:* | 7.5 errata_012 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_013:*:*:*:*:*:* | 7.5 errata_013 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.5:errata_014:*:*:*:*:*:* | 7.5 errata_014 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:-:*:*:*:*:*:* | 7.6 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:errata_001:*:*:*:*:*:* | 7.6 errata_001 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:errata_002:*:*:*:*:*:* | 7.6 errata_002 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:errata_003:*:*:*:*:*:* | 7.6 errata_003 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:errata_004:*:*:*:*:*:* | 7.6 errata_004 | Vulnerable | OpenBSD |
| cpe:2.3:o:openbsd:openbsd:7.6:errata_005:*:*:*:*:*:* | 7.6 errata_005 | Vulnerable | OpenBSD |
- cpe:2.3:o:openbsd:openbsd:7.5:errata_009:*:*:*:*:*:* Versions 7.5 errata_009 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_010:*:*:*:*:*:* Versions 7.5 errata_010 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_011:*:*:*:*:*:* Versions 7.5 errata_011 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_012:*:*:*:*:*:* Versions 7.5 errata_012 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_013:*:*:*:*:*:* Versions 7.5 errata_013 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.5:errata_014:*:*:*:*:*:* Versions 7.5 errata_014 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:-:*:*:*:*:*:* Versions 7.6 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:errata_001:*:*:*:*:*:* Versions 7.6 errata_001 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:errata_002:*:*:*:*:*:* Versions 7.6 errata_002 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:errata_003:*:*:*:*:*:* Versions 7.6 errata_003 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:errata_004:*:*:*:*:*:* Versions 7.6 errata_004 Vulnerable ·OpenBSD
- cpe:2.3:o:openbsd:openbsd:7.6:errata_005:*:*:*:*:*:* Versions 7.6 errata_005 Vulnerable ·OpenBSD
Remediation
- Fix · CNA OpenBSD (OpenBSD) Fixed in 7.6 errata 006, 7.6 errata 008, 7.5 errata 015
Timeline
- 2026-10-02 Threatist record created from CVE-2025-30334
- 2026-10-03 Alias added: GHSA-pxc8-qhvr-5954
More Openbsd vulnerabilities
- TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
- TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
- TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
- TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
- TI-2026-40218 sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication… CVSS 3.1HIGH 8.3
- TI-2004-00444 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31… CVSS 2.0HIGH 10.0
Sources
- CVE-2025-30334 · CVE Program
- CVE-2025-30334 · NVD
- FIRST EPSS
- GHSA-pxc8-qhvr-5954 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences