Skip to main content

OpenVPN CVE-2026-13379

| EUVDEUVD-2026-51233 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-02 GHSA-hpxm-29ww-fvf4
Buffer Overflow Information Disclosure Microsoft Openvpn
5.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.7 HIGH

AC:H reflects the specific --dns combination prerequisite (AT:P); S:C and C:H/A:H capture system-wide DNS corruption beyond the OpenVPN process boundary.

3.1 AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:H
4.0 AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H
SUSE
7.7 HIGH
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:H

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 30, 2026 - 17:33 vuln.today
Analysis Generated
Jul 30, 2026 - 17:33 vuln.today
CVSS changed
Jul 30, 2026 - 17:22 NVD
5.1 (MEDIUM)
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)
CVE Published
Jul 02, 2026 - 10:57 github-releases
MEDIUM 5.1

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

DNS SearchList state pollution in OpenVPN's Windows service component (openvpnserv) corrupts the host's pre-connection DNS configuration during VPN connect and disconnect events on Windows. Specific combinations of --dns configuration directives interact with the local DNS setup to leave the Windows DNS SearchList in a corrupted state after session teardown, potentially routing post-VPN DNS queries to unintended resolvers and causing system-wide name resolution failures. No active exploitation has been confirmed (not in CISA KEV); a vendor-released patch is available in v2.7.5, and no public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in openvpnserv, the privileged Windows service that manages network interface configuration - including DNS settings - during OpenVPN tunnel establishment and teardown. On connect, the service modifies the Windows DNS SearchList to route queries through the VPN's configured resolvers; on disconnect, it is expected to restore the pre-VPN state. The flaw causes the service to fail to properly restore the original DNS SearchList when specific --dns directive combinations are present, leaving the host's DNS configuration in a polluted state. The assigned CWE-125 (Out-of-bounds Read) appears inconsistent with the described state management failure; the root cause reads more accurately as a logic or state-restoration error (closer to CWE-840 or CWE-459), and this discrepancy should be verified against the full vendor security announcement at https://community.openvpn.net/Security%20Announcements/CVE-2026-13379. The CVSS 4.0 vector's SC:H and SA:H ratings reflect that the impact extends to the broader Windows host's name resolution infrastructure, not merely the OpenVPN process.

RemediationAI

Upgrade to OpenVPN v2.7.5 or later; this release contains the vendor-confirmed fix for DNS SearchList state pollution, as documented at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5. As a compensating control pending upgrade, administrators can remove or avoid the specific --dns directive combinations in the OpenVPN server or client configuration and rely on legacy --dhcp-option DNS syntax instead, though this may reduce DNS routing flexibility. A secondary workaround is to implement an OpenVPN --down script that explicitly restores the Windows DNS SearchList to its pre-VPN state on disconnect, using netsh interface ip set dns commands; this adds operational complexity and must be maintained per-interface. Neither workaround is a substitute for patching.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-13379 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy