PT-2026-26148 · Wireguard+2 · Wireguard+2
Skoveit
·
Published
2026-03-17
·
Updated
2026-03-27
·
CVE-2026-32941
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Sliver versions 1.7.3 and below
Description
Sliver is a command and control framework that utilizes a custom Wireguard network stack. Versions 1.7.3 and below contain a Remote Out-of-Memory (OOM) issue in the mTLS and WireGuard C2 transport layer of the Sliver C2 server. The
socketReadEnvelope and socketWGReadEnvelope functions rely on an attacker-controlled 4-byte length prefix to allocate memory, with ServerMaxMessageSize allowing single allocations of up to approximately 2 GiB. A compromised implant or an attacker with valid credentials can exploit this by sending fabricated length prefixes over concurrent yamux streams (up to 128 per connection), forcing the server to attempt allocating approximately 256 GiB of memory and triggering an OS OOM kill. This crashes the Sliver server, disrupts all active implant sessions, and may degrade or kill other processes sharing the same host. The same pattern also affects all implant-side readers, which lack any upper-bound check. The issue was not resolved at the time of publication.Recommendations
Versions prior to 1.7.4 are vulnerable.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Sliver
Wireguard
Yamux