Skip to main content

OpenVPN CVE-2026-12932

| EUVDEUVD-2026-51241 HIGH
Memory Leak (CWE-401)
2026-07-02 GHSA-93p4-5c7j-q5rx
Information Disclosure Microsoft Openvpn
7.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable, low-complexity memory leak; PR:L reflects the tls-crypt-v2 client-key context; impact is availability-only (OOM/crash), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 30, 2026 - 17:30 vuln.today
Analysis Generated
Jul 30, 2026 - 17:30 vuln.today
CVSS changed
Jul 30, 2026 - 17:22 NVD
7.1 (HIGH)
CVE Published
Jul 02, 2026 - 10:57 github-releases
HIGH 7.1
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Remote denial of service in OpenVPN servers (fixed in 2.7.5 and 2.6.21) arises from a memory leak in tls-crypt-v2 client key handling: an attacker sending a suitable sequence of tls-crypt-v2 packets can force unbounded memory allocation, driving the server into an out-of-memory condition and subsequent crash. Only availability is impacted - no data disclosure or code execution. No public exploit identified at time of analysis; not listed in CISA KEV.

Technical ContextAI

OpenVPN's tls-crypt-v2 feature wraps and authenticates control-channel packets using per-client keys, extending the older tls-crypt to give each client a distinct key delivered inside the handshake. The flaw is classified CWE-401 (Missing Release of Memory after Effective Lifetime): during processing of tls-crypt-v2 client key material, allocated buffers are not freed along certain paths, so repeated or crafted packets accumulate unreleased memory. Because tls-crypt-v2 processing happens early in the control-channel state machine, the leak is reachable before full session establishment. A closely related leak in the same code area (CVE-2026-13698, reported by Max Fillinger) was fixed by the same 2.7.5 change and is believed to overlap this report from Valton Tahiri.

RemediationAI

Vendor-released patch: upgrade to OpenVPN 2.7.5 or 2.6.21, which fix the tls-crypt-v2 client-key memory leak (per the GitHub release and OpenVPN security announcement); on Ubuntu apply the packages from USN-8540-1. If immediate patching is not possible, the practical compensating control is to reduce exposure of the tls-crypt-v2 attack surface: restrict which hosts can reach the OpenVPN UDP/TCP listener via firewall/ACLs so only expected client networks can send control-channel traffic, and monitor the server process for abnormal memory growth so an OOM can be caught before service loss. Disabling tls-crypt-v2 is a possible last-resort workaround but has a significant trade-off - it removes per-client control-channel key protection and would break clients provisioned with tls-crypt-v2 keys - so it is not recommended over upgrading. Advisory URLs: https://community.openvpn.net/Security%20Announcements/CVE-2026-12932 and https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-12932 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy