OpenVPN ovpn-dco-win CVE-2026-105390

Exploitation requires local access to a Windows host on which the OpenVPN Data Channel Offload driver (ovpn-dco-win) is installed, in an affected version range (0.6.5 through 1.3.5, or 2.4.0 through 2.8.7). The attacker must be able to open a handle to the ovpn-dco device object and send a crafted write to it; the improper synchronization then deadlocks the driver. Limiting factors: there is no remote attack vector (AV:L), so the attacker must already have local presence on the machine; impact is confined to denial of service (host becomes unresponsive, typically requiring reboot) with no code execution, no privilege gain, and no data exposure. A practical additional limiter is the access-control list on the ovpn-dco device - if it restricts writes to privileged accounts, unprivileged local exploitation would not be possible.

All signals point to a locally-exploitable denial-of-service of modest priority. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a local attacker, needing no special privileges or user interaction, issues a crafted write to the ovpn-dco device and deadlocks the driver, with impact confined to availability (VA:H) and no confidentiality or integrity effect. The 6.9 MEDIUM score reflects that the local attack vector caps real-world risk - there is no remote reachability and no code execution or data exposure. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or probable exploitation; exploitation status is 'no public exploit identified at time of analysis.' CWE-413 (improper resource locking) matches the 'improper synchronization / deadlock' narrative, lending consistency. One conflict to flag: the input Tags claim 'Information Disclosure,' which directly contradicts the CVSS vector (VC:N) and the description - this is an availability/DoS issue, not disclosure. Note also PR:N assumes any local user can open and write to the ovpn-dco device object; if default device ACLs restrict that handle to privileged accounts, effective privilege requirements would be higher - verify device permissions with the vendor.

A local user (or malware already running with ordinary user rights) on a Windows host that has the OpenVPN DCO driver installed opens the ovpn-dco device and issues a specially crafted write. The improper synchronization in the driver's locking causes a deadlock, hanging the driver and rendering the host unresponsive until reboot. No public exploit code was identified at the time of analysis, and exploitation yields only denial of service, not code execution or data access.