Skip to main content

OpenVPN EUVDEUVD-2026-35200

| CVE-2026-40215 MEDIUM
Out-of-bounds Read (CWE-125)
2026-04-22
Buffer Overflow Information Disclosure Openvpn
6.1
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
6.1 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:L/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
6.8 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jun 08, 2026 - 21:24 vuln.today
Analysis Generated
Jun 08, 2026 - 21:24 vuln.today
CVSS changed
Jun 08, 2026 - 21:22 NVD
6.1 (MEDIUM)
Patch released
Apr 24, 2026 - 12:21 nvd
Patch available
CVE Published
Apr 22, 2026 - 19:46 nvd
N/A

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

OpenVPN's TLS handshake race condition exposes confidential packet data from prior handshake sessions to authenticated remote attackers, affecting versions before 2.6.20 in the 2.6.x branch and before 2.7.2 in the 2.7.x branch. The CWE-125 out-of-bounds read flaw scores 6.1 under CVSS 4.0 with High confidentiality and availability impacts, though the AC:H (High Complexity) rating reflects that successful exploitation requires winning a narrow timing window, limiting opportunistic mass exploitation. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patches for both stable branches were published April 22, 2026.

Technical ContextAI

OpenVPN is a widely-deployed open-source VPN solution that uses TLS for its control channel, managing session establishment and renegotiation through a TLS state machine. The root cause class is CWE-125 (Out-of-bounds Read): a race condition in the handshake logic creates a time-of-check-to-time-of-use window where shared handshake state can be accessed without adequate synchronization. When the race is won, memory belonging to a previous handshake context is read out-of-bounds and can be included in packet data transmitted to the current session, constituting an information disclosure. The 'Buffer Overflow' tag in the source data appears to be a tagging imprecision - CWE-125 is a read-side flaw, not a write overflow. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N) confirms network reachability with high complexity and low-privilege authentication required, consistent with a race condition exploitable only by an established, authenticated VPN peer. This vulnerability is distinct from CVE-2026-35058, a server ASSERT crash via malformed tls-crypt-v2 packets that was fixed in the same v2.6.20 and v2.7.2 releases.

RemediationAI

Upgrade to OpenVPN 2.6.20 or OpenVPN 2.7.2, both released April 22, 2026, which contain the direct fix for this race condition. Binaries and source are available at https://github.com/OpenVPN/openvpn/releases/tag/v2.6.20 and via the OpenVPN Community Downloads page for Windows MSI installers. Linux package users should follow their distribution's advisory; Ubuntu users should apply the update referenced in USN-8286-1 (https://ubuntu.com/security/notices/USN-8286-1) and consult community Linux package repos per the OpenVPN wiki. If immediate patching is not feasible, restrict which clients are permitted to initiate TLS renegotiation by reviewing server-side renegotiation configuration (--renegotiate-seconds and --reneg-bytes options), though disabling renegotiation entirely may impact long-lived sessions and has the trade-off of keeping TLS sessions alive with older key material. Additionally, narrowing the authenticated client pool - by auditing certificate issuance and revoking certificates for untrusted clients - reduces the PR:L attack surface, since only authenticated peers can trigger the race. These compensating controls do not eliminate the vulnerability and patching remains the only confirmed remediation.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

Share

EUVD-2026-35200 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy