Threat database

CVE-2026-105390 is a medium severity vulnerability in OpenVPN's ovpn-dco-win component for Windows. It affects versions from 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7. The flaw involves improper synchronization that allows local attackers to cause a deadlock by crafting a write to the ovpn-dco device, potentially making the host system unresponsive.

CVE-2026-82325 is a use-after-free vulnerability in the OpenVPN ovpn-dco-win driver affecting versions 2.5.0 through 2.8.6. This flaw allows local authenticated users to cause a system crash by sending crafted control messages. The vulnerability has a medium severity rating with a CVSS score of 6.8. No public exploits are known, and no patch or vendor advisory information is provided regarding remediation.

OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

CVE-2026-9560 is a critical privilege escalation vulnerability in OpenVPN Connect versions 3.5.1 through 3.8.1 on macOS. It allows an attacker with local access to execute arbitrary commands with elevated privileges via a local inter-process communication (IPC) channel in the background service. The vulnerability is related to improper handling of IPC leading to command injection. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.

Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet

Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows configured remote SAML Assertion Consumer Service (ACS) endpoint servers to inject arbitrary web script or HTML via the RelayState parameter

Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash

CVE-2023-46850 is a use-after-free vulnerability in OpenVPN Community Edition versions 2.6.0 through 2.6.6. This flaw arises when network buffers are sent to a remote peer, potentially causing undefined behavior, memory leaks, or remote code execution. Exploitation does not require authentication but involves network interaction with a vulnerable OpenVPN server or client. Although no known exploits are currently reported in the wild, successful exploitation could compromise confidentiality, integrity, and availability of VPN communications. European organizations relying on OpenVPN for secure remote access and site-to-site VPNs are at risk, especially critical infrastructure and enterprises with high VPN usage. Mitigation involves promptly updating to patched versions once available, employing network-level filtering to restrict OpenVPN traffic, and monitoring for anomalous VPN behavior.