Skip to main content

ovpn-dco-win CVE-2026-11604

| EUVD-2026-36151 MEDIUM
Incorrect Calculation of Buffer Size (CWE-131)
2026-06-10 OpenVPN GHSA-f6c5-28vq-94w2
Denial Of Service Buffer Overflow Ovpn Dco Win
5.6
CVSS 4.0 · Vendor: OpenVPN
Share

Severity by source

Vendor (OpenVPN) PRIMARY
5.6 MEDIUM
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.3 MEDIUM

Network-delivered crafted packet from authenticated peer (AV:N, PR:L); specific epoch key codepath required (AC:H); kernel driver crash changes scope (S:C); availability-only DoS impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (OpenVPN).

CVSS VectorVendor: OpenVPN

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 10, 2026 - 22:05 vuln.today

DescriptionCVE.org

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

AnalysisAI

Heap-based buffer overflow in OpenVPN's ovpn-dco-win Windows kernel driver (versions 2.0.0-2.8.3) allows a remote authenticated VPN peer to crash the host system by sending a crafted data packet that exploits an incorrect buffer size calculation in the epoch key generator. Because the vulnerable code executes in kernel mode, the resulting memory corruption causes a full system crash (BSOD), not a user-space fault. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain valid VPN client credentials
Delivery
Authenticate as remote VPN peer
Exploit
Craft data packet exploiting epoch key generator
Install
Send packet to trigger buffer size miscalculation
C2
Overflow kernel heap allocation
Execute
Corrupt kernel memory
Impact
System crash (BSOD/DoS)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The target Windows host must have the ovpn-dco-win kernel driver loaded and active, meaning the OpenVPN Data Channel Offload feature must be explicitly in use - deployments not utilizing DCO are not affected. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 5.6 with vector AV:L/AC:H/AT:P/PR:L/UI:P indicates moderate assessed severity, with high availability impact on both the vulnerable system (VA:H) and subsequent systems (SA:H), reflecting the OS-level crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario A malicious or compromised VPN client that holds valid authentication credentials connects to a Windows host running ovpn-dco-win 2.0.0-2.8.3 and establishes an authenticated session. The attacker then transmits a crafted data packet engineered to trigger the buffer size miscalculation in the epoch key generator, overflowing a kernel heap allocation and corrupting kernel memory, causing an immediate system crash. …
Remediation Upgrade ovpn-dco-win to the patched release published by OpenVPN; consult https://github.com/OpenVPN/ovpn-dco-win/releases to identify the minimum safe version beyond 2.8.3, as the exact fix version is not specified in the available input data and should not be inferred. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-11604 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy