Skip to main content

OpenVPN CVE-2026-11771

| EUVDEUVD-2026-51237 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-07-02 GHSA-v8ww-fhqp-9vff
Buffer Overflow Microsoft Stack Overflow Openvpn
7.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.0 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable via a malicious proxy but needs non-default NTLMv2 proxy config plus victim connection (AC:H, UI:R); one-byte overrun yields crash-only availability impact, so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
SUSE
6.1 MEDIUM
AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 30, 2026 - 17:29 vuln.today
Analysis Generated
Jul 30, 2026 - 17:29 vuln.today
CVSS changed
Jul 30, 2026 - 17:22 NVD
7.0 (HIGH)
CVE Published
Jul 02, 2026 - 10:57 github-releases
HIGH 7.0
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Denial of service in OpenVPN's HTTP proxy client allows a malicious or man-in-the-middle proxy server to trigger a one-byte stack buffer overrun by returning a crafted NTLMv2 authentication response, potentially crashing the client. This CVE-2026-11771 flaw was fixed in the coordinated OpenVPN 2.7.5 / 2.6.21 release of 1 July 2026 alongside several other memory-safety bugs; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is limited to availability (VA:H) with no confidentiality or integrity effect, and exploitation only applies to clients configured to route through an NTLMv2-authenticated HTTP proxy.

Technical ContextAI

OpenVPN is a widely used open-source TLS VPN daemon that can tunnel its connection through an upstream HTTP proxy, optionally authenticating with NTLM/NTLMv2. The vulnerability is a CWE-121 stack-based buffer overflow (a one-byte out-of-bounds write) in the code that parses NTLMv2 responses received from the proxy server during the proxy authentication handshake. Because the overrun is driven by attacker-influenced proxy response data rather than by the VPN control channel, it sits in the client-side proxy negotiation path, distinct from the other same-release fixes (use-after-free in ack_write_buf()/tls_wrap_reneg(), tls-crypt-v2 memory leaks) which affect the server-side TLS control channel.

RemediationAI

Vendor-released patch: upgrade to OpenVPN 2.7.5 or 2.6.21 (or later), which fix the NTLMv2 proxy-response overrun; Ubuntu users should apply the packages in USN-8540-1. If immediate patching is not possible, the most direct compensating control is to stop using NTLMv2 HTTP-proxy authentication - either remove the --http-proxy/NTLM proxy configuration and connect directly, or switch the proxy auth method to basic/none where the environment allows, which avoids the vulnerable parsing path entirely at the cost of losing NTLM single-sign-on to the proxy. Where a proxy is mandatory, restrict clients to a trusted, authenticated upstream proxy and protect the client-to-proxy path against interception (e.g. enforce it over a trusted network segment) to remove the malicious/MITM-proxy precondition. Advisories: https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5 and https://community.openvpn.net/Security%20Announcements/CVE-2026-11771.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-121 – Stack-based Buffer Overflow

View all
CVE-2025-0282 CRITICAL POC
9.0
CVE-2025-22457 CRITICAL POC
9.8
CVE-2012-10060 CRITICAL POC
9.3
CVE-2012-10053 CRITICAL POC
9.3
CVE-2013-10064 CRITICAL POC
9.3
CVE-2012-10023 MEDIUM POC
6.9
CVE-2012-10058 CRITICAL POC
10.0
CVE-2013-10068 CRITICAL POC
9.4

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-11771 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy