Skip to main content

OpenVPN CVE-2026-13117

| EUVDEUVD-2026-51234 MEDIUM
Use After Free (CWE-416)
2026-07-02 GHSA-6qjm-gj5v-hp7g
Information Disclosure Use After Free Memory Corruption Microsoft Openvpn
6.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable but requires authenticated client (PR:L) and precise packet timing (AC:H); primary impact is server crash (A:H) with marginal UAF memory exposure (C:L), no integrity effect.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 30, 2026 - 17:32 vuln.today
Analysis Generated
Jul 30, 2026 - 17:32 vuln.today
CVSS changed
Jul 30, 2026 - 17:22 NVD
6.0 (MEDIUM)
CVE Published
Jul 02, 2026 - 10:57 github-releases
MEDIUM 6.0
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Use-after-free in OpenVPN's tls_wrap_reneg() function allows an authenticated remote client to crash the OpenVPN server by sending a crafted sequence of dynamic tls-crypt control-channel packets, resulting in denial of service for all connected VPN users. Affected versions prior to 2.7.5 and 2.6.21 are patched as of July 1, 2026. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the vulnerability was independently discovered by multiple research teams, elevating credibility of the finding.

Technical ContextAI

CWE-416 (Use After Free) in the tls_wrap_reneg() function within OpenVPN's TLS renegotiation handling code. The vulnerability is exercisable only when the dynamic tls-crypt feature (tls-crypt-v2) is active on the server, because the trigger path involves processing dynamic tls-crypt control-channel packets. Use-after-free conditions occur when memory is freed and subsequently dereferenced; in this context, a carefully ordered sequence of control-channel packets causes a reference to freed memory within the renegotiation logic, leading to memory corruption and typically a process crash. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L) confirms network reachability with high complexity and low-privilege authentication. CPE-level version data is not included in the input, but the OpenVPN community release history and GitHub release v2.7.5 (also backported to 2.6.21) identify the fix boundary. Tags in the source intelligence include 'Use After Free' and 'Memory Corruption', consistent with CWE-416. The 'Microsoft' and 'Information Disclosure' tags appear to be erroneous metadata - no Microsoft component is involved, and confidentiality impact (VC:L) is marginal rather than the defining characteristic.

RemediationAI

Upgrade OpenVPN to version 2.7.5 or 2.6.21 (both released July 1, 2026), available from the official GitHub release at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5 and the OpenVPN community release page at https://community.openvpn.net/ReleaseHistory. Ubuntu users should apply the packages provided in USN-8540-1. If immediate patching is not feasible, disabling the tls-crypt-v2 (dynamic tls-crypt) feature removes the trigger path for this vulnerability - servers not using '--tls-crypt-v2' in their configuration are not exposed to this specific code path; however, disabling tls-crypt-v2 reduces control-channel authentication protection and may affect client compatibility if tls-crypt-v2 keys are deployed. Access control at the VPN gateway to restrict which clients can initiate connections provides marginal reduction in exposure but does not eliminate risk from authenticated-but-malicious clients.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-13117 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy