CVE-2026-19380

LowCVSS 2.3/10Last modified Oct 23, 2026

Description

A vulnerability was identified in Mullvad wireguard.sys 0.10.1. The affected element is the function AdapterState of the component IOCTL Handler. Such manipulation leads to improper update of reference count. Local access is required to approach this attack. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure.

Metrics

CVSS 3.1 2.3/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-664 CWE-911

Affected software

No affected versions have been published.

Timeline

Published: Aug 10, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-193817.8A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the CVE-2026-193822.3A weakness has been identified in Almico Speedfan 4.52. This affects the function KiSystemCall64 in the library speedfan.sys of the componen CVE-2026-193834.7A security vulnerability has been detected in saithink/saigroup SaiAdmin up to 5.0.1. This impacts the function shell_exec of the file /app/CVE-2026-193847.3A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the f CVE-2026-193858.8Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operat CVE-2026-193869.3A stack-based buffer overflow in the ASUS router modules allows an authenticated nearby user to execute arbitrary code via a crafted configu CVE-2026-193877.6A heap out-of-bounds write vulnerability was found in the GStreamer gst-plugins-bad adpcmdec element when decoding IMA/DVI ADPCM audio. Insu CVE-2026-193897.1Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing hea CVE-2026-19396.4The Percent to Infograph plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `percent_to_graph` shortcode in all versi CVE-2026-193916.5A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'pass CVE-2026-193956.6In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty va CVE-2026-193967.7A predictable seed in the pseudo-random number generator (PRNG) in the IFTTT pairing token generation of the ASUS RT-BE57 router allows an u