EUVD-2026-36151
GHSA-f6c5-28vq-94w2
Severity by source
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered crafted packet from authenticated peer (AV:N, PR:L); specific epoch key codepath required (AC:H); kernel driver crash changes scope (S:C); availability-only DoS impact.
Primary rating from Vendor (OpenVPN).
CVSS VectorVendor: OpenVPN
Lifecycle Timeline
1DescriptionCVE.org
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
AnalysisAI
Heap-based buffer overflow in OpenVPN's ovpn-dco-win Windows kernel driver (versions 2.0.0-2.8.3) allows a remote authenticated VPN peer to crash the host system by sending a crafted data packet that exploits an incorrect buffer size calculation in the epoch key generator. Because the vulnerable code executes in kernel mode, the resulting memory corruption causes a full system crash (BSOD), not a user-space fault. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis, though the kernel-level availability impact is severe when conditions are met.
Technical ContextAI
ovpn-dco-win is the Windows kernel-mode driver implementing OpenVPN's Data Channel Offload (DCO) feature, which accelerates VPN session throughput by handling encryption and packet processing in kernel space rather than user space. The epoch key generator within this driver manages cryptographic key material lifecycle for VPN sessions. CWE-131 (Incorrect Calculation of Buffer Size) identifies the root cause: the generator computes an insufficient heap allocation size for key-related structures, and when a specially crafted data packet exercises this codepath, the resulting write overflows the allocated buffer and corrupts adjacent kernel memory. Because this occurs in a kernel-mode driver, there is no user-space isolation boundary - corruption propagates directly to the Windows kernel, triggering a bugcheck. The CPE string cpe:2.3:a:openvpn:ovpn-dco-win:*:*:*:*:*:*:*:* confirms that only the ovpn-dco-win component by OpenVPN is affected, not OpenVPN's broader suite or non-DCO configurations.
RemediationAI
Upgrade ovpn-dco-win to the patched release published by OpenVPN; consult https://github.com/OpenVPN/ovpn-dco-win/releases to identify the minimum safe version beyond 2.8.3, as the exact fix version is not specified in the available input data and should not be inferred. The full vendor advisory is at https://community.openvpn.net/Security%20Announcements/CVE-2026-11604. Where immediate upgrade is operationally not possible, the most effective compensating control is disabling the Data Channel Offload feature in the OpenVPN configuration - removing or disabling the DCO directive causes OpenVPN to fall back to user-space packet processing, bypassing the vulnerable kernel driver entirely; the trade-off is reduced VPN throughput. Additionally, enforcing strict certificate-based mutual TLS authentication with a tightly scoped CA limits the pool of peers who can reach the vulnerable codepath to explicitly authorized endpoints, reducing but not eliminating risk since the vulnerability itself lies post-authentication.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker
Same weakness CWE-131 – Incorrect Calculation of Buffer Size
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today