EUVD-2026-112136
GHSA-h484-rm8p-m8mw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated unprivileged local access on Windows host
-
ExploitInitiate TCP connect operations on ovpn-dco-win driver
-
ExecutionWin race condition in connect path
-
ImpactTrigger kernel/system crash (denial of service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already have an unprivileged but authenticated local account with the ability to execute code on a Windows host that is running OpenVPN with the ovpn-dco-win (Data Channel Offload for Windows) kernel driver, in an affected version 0.6.5 through 2.8.13. Exploitation requires winning a race condition in the driver's TCP connect path (reflected as AT:P), so it is timing-dependent and probabilistic rather than guaranteed. Limiting factors: no remote exploitation is possible (AV:L), the ovpn-dco-win driver component must be present and in use (the newer DCO data path, not the legacy tun/tap path), and the impact is confined to availability - a crash - with no confidentiality or integrity effect. |
| Impact | This is a moderate-severity, low-real-world-priority issue. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) describes a local attack requiring an authenticated low-privileged account and a specific attack requirement (the race window), with impact limited to availability (VA:H; VC:N/VI:N) - a system crash, not code execution or data exposure. There is no CISA KEV listing, no EPSS score in the provided data, and no public exploit identified; the only reference is the OpenVPN vendor advisory. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with routine scheduled patching rather than urgent response. The signals are mutually consistent: a local-only, privilege-requiring, availability-only denial of service with no evidence of exploitation reads as a genuine but non-emergency bug. EPSS is absent, so probabilistic exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | A low-privileged user already logged in to a Windows host running OpenVPN with the ovpn-dco-win data-channel-offload kernel driver repeatedly triggers TCP connect operations to win a timing race in the connect path, crashing the system. Because the impact is a kernel/system crash, the result is denial of service against the whole machine, affecting all users. No public exploit code was identified at the time of analysis; the race condition (AT:P) means exploitation is probabilistic rather than deterministic. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Local users holding only low-privileged accounts on a Windows host can crash the entire machine by triggering a race condition in the TCP connect path of OpenVPN's ovpn-dco-win Data Channel Offload kernel driver (versions 0.6.5 through 2.8.13). Impact is availability-only - a system-wide crash - with no effect on confidentiality or integrity, and exploitation requires an existing local account plus winning a timing window, so it is probabilistic rather than deterministic. No public exploit code and no confirmed active exploitation were identified at time of analysis; this is assessed as a moderate-severity, low-real-world-priority issue that should be handled in the normal monthly patch cycle.
RemediationAI
No vendor-released patch version is listed in the data available for this analysis, so the fixed release should be confirmed from the OpenVPN security announcement at https://community.openvpn.net/Security%20Announcements/CVE-2026-115402 and the driver updated as soon as that version is published. As a compensating control, affected hosts can be switched off the DCO data path back to the legacy tap-windows6/tun path, which removes the vulnerable kernel driver from the packet flow entirely - the trade-off is a measurable loss of throughput and higher CPU usage, so this suits high-value endpoints rather than fleets. Because the attacker must already be able to log on locally and execute code, tightening local logon rights on OpenVPN endpoints (removing interactive logon for non-administrative and service accounts) reduces the pool of potential trigger sources at the cost of administrative convenience. Finally, treat repeated unexpected kernel bugchecks (for example Kernel-Power event ID 41 without a corresponding hardware or power cause) on OpenVPN endpoints as a possible sign of abuse of this race and correlate them with local logon activity.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ovpn-dco-win is OpenVPN's Data Channel Offload driver for Windows, which moves VPN packet processing out of the userspace tun/tap path and into a kernel-mode driver for throughput and latency gains. The flaw is a classic CWE-362 race condition: shared state in the driver's TCP connect path is not correctly serialized, so a local caller that interleaves operations in that path can drive the driver into an inconsistent state and take down the whole operating system (a kernel-level crash rather than an application crash). Both the CVSS 4.0 vector published with the CVE (AT:P) and our independent CVSS 3.1 assessment (AC:H) reflect that the attacker must hit a narrow timing window; the CVE's AV:L and PR:L metrics confirm the attack surface is strictly local and requires only low privileges, and the total absence of C/I impact metrics confirms this is purely a denial-of-service condition. The trigger is confined to the DCO code path; deployments still using the legacy tun/tap data path do not expose this driver code.
Know when Openvpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local-only access by a low-privileged user (AV:L/PR:L); the race condition makes the trigger timing-dependent (AC:H); impact is a system crash, so A:H with C:N/I:N.
Primary rating from Vendor (OpenVPN).
CVSS VectorVendor: OpenVPN
DescriptionCVE.org
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker
Exploit-DB