CVE-2023-46850VulnerabilityPublished 11 Nov 2023Updated 16 Dec 2025

CVE-2023-46850: OpenVPN 2 (Community) · Use After Free

Affects OpenVPN 2 (Community)Source CVE Database V5

Not known to be exploited.

Data as of 25 Oct 2026, 19:02 UTC

Severity

High

Rated High by the CNA (OpenVPN) · No CVSS score from NVD or the CNA

EPSS: 1.9% chance of exploitation in 30 days – higher than 80% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 11 Nov 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Debiandebian/openvpn`pkg:deb/debian/openvpn`Other threats	Affected =2.6.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

1. Monitor OpenVPN vendor communications closely and apply security patches immediately once they become available for versions 2.6.0 through 2.6.6. 2. Until patches are released, restrict OpenVPN traffic to trusted IP addresses and networks using firewall rules or network segmentation to reduce exposure to untrusted sources. 3. Employ intrusion detection and prevention systems (IDS/IPS) with signatures or heuristics capable of detecting anomalous OpenVPN traffic patterns indicative of exploitation attempts. 4. Conduct regular audits of VPN server and client configurations to ensure minimal exposure and adherence to security best practices, including disabling unnecessary features or protocols. 5. Implement robust logging and monitoring of VPN endpoints to detect unusual activity or crashes that may indicate exploitation attempts. 6. Educate network administrators and security teams about this vulnerability to ensure rapid response and incident handling. 7. Consider deploying network-level mitigations such as rate limiting or deep packet inspection for OpenVPN traffic to identify and block malformed packets. 8. Evaluate alternative VPN solutions or versions not affected by this vulnerability if immediate patching is not feasible.

Description

CVE-2023-46850 is a use-after-free vulnerability in OpenVPN Community Edition versions 2.6.0 through 2.6.6. This flaw arises when network buffers are sent to a remote peer, potentially causing undefined behavior, memory leaks, or remote code execution. Exploitation does not require authentication but involves network interaction with a vulnerable OpenVPN server or client. Although no known exploits are currently reported in the wild, successful exploitation could compromise confidentiality, integrity, and availability of VPN communications. European organizations relying on OpenVPN for secure remote access and site-to-site VPNs are at risk, especially critical infrastructure and enterprises with high VPN usage. Mitigation involves promptly updating to patched versions once available, employing network-level filtering to restrict OpenVPN traffic, and monitoring for anomalous VPN behavior.

Impact

For European organizations, the impact of CVE-2023-46850 could be severe due to OpenVPN's widespread use for secure remote access and inter-site connectivity. Exploitation could lead to unauthorized access to internal networks, data exfiltration, or disruption of VPN services, undermining confidentiality, integrity, and availability of sensitive communications. Critical sectors such as finance, healthcare, government, and energy, which rely heavily on VPNs for secure operations, could face operational disruptions or data breaches. The vulnerability's remote exploitability without authentication increases the attack surface, especially for organizations with exposed VPN endpoints. Additionally, memory leaks or crashes could degrade service availability, impacting business continuity. The lack of known exploits currently provides a window for proactive mitigation, but the potential for future exploitation necessitates urgent risk management. European organizations with regulatory compliance obligations (e.g., GDPR) must consider the data protection implications of potential breaches stemming from this vulnerability.

Summary

CVE-2023-46850 is a use-after-free vulnerability classified under CWE-416 affecting OpenVPN Community Edition versions 2.6.0 through 2.6.6. The vulnerability occurs when OpenVPN processes network buffers sent to a remote peer, leading to the use of memory after it has been freed. This can cause undefined behavior including leaking of memory buffers or potentially remote code execution on the vulnerable system. The flaw is triggered by network traffic, meaning an attacker can exploit it remotely without prior authentication by sending specially crafted packets to an OpenVPN instance. The absence of a CVSS score indicates that the vulnerability has been recently disclosed and not yet fully assessed, but the nature of use-after-free bugs combined with remote exploitability suggests a significant risk. No public exploits are known at this time, but the vulnerability could allow attackers to compromise VPN endpoints, leading to unauthorized access, data leakage, or disruption of VPN services. OpenVPN is widely used across enterprises and critical infrastructure for secure communications, making this vulnerability impactful. The vulnerability affects all deployments running the specified vulnerable versions, including both client and server configurations. The lack of available patches at the time of disclosure necessitates immediate attention to mitigate exposure through network controls and monitoring until updates are released.

CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Architecture and Design · Language Selection
Choose a language that provides automatic memory management.
Implementation · Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 23 Dec 2025, 18:33 UTC

WeaknessesCWE-416

Technical details

References

Community reviews

Related threats