Skip to main content

Ubuntu CVE-2025-12106

| EUVD-2025-199988 CRITICAL
Buffer Over-read (CWE-126)
2025-12-01 security@openvpn.net
Buffer Overflow Ubuntu Debian Openvpn Suse
Critical
Disputed · 9.1 NVD
Share

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Ubuntu
MEDIUM
qualitative
SUSE
CRITICAL
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 13:34 euvd
EUVD-2025-199988
Analysis Generated
Mar 15, 2026 - 13:34 vuln.today
CVE Published
Dec 01, 2025 - 13:16 nvd
CRITICAL 9.1

DescriptionCVE.org

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Analysis

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Technical ContextAI

This vulnerability is classified as Buffer Over-read (CWE-126).

RemediationAI

Monitor vendor advisories for patches. Apply mitigations such as network segmentation, access restrictions, and monitoring.

Vendor StatusVendor

Ubuntu

Priority: Medium
openvpn
Release Status Version
trusty not-affected code not present
xenial not-affected code not present
bionic not-affected code not present
focal not-affected code not present
jammy not-affected code not present
noble not-affected code not present
plucky not-affected code not present
questing not-affected code not present
upstream not-affected debian: Vulnerable code only in 2.7 upstream

Debian

openvpn
Release Status Fixed Version Urgency
bullseye fixed 2.5.1-3 -
bullseye (security) fixed 2.5.1-3+deb11u2 -
bookworm, bookworm (security) fixed 2.6.3-1+deb12u4 -
trixie (security), trixie fixed 2.6.14-1+deb13u1 -
forky, sid fixed 2.7.0-1 -
(unstable) not-affected - -

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

Share

CVE-2025-12106 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy