Skip to main content

OpenVPN EUVDEUVD-2026-51239

| CVE-2026-12996 MEDIUM
Out-of-bounds Read (CWE-125)
2026-07-02 GHSA-7226-c5q3-mc6p
Buffer Overflow Information Disclosure Microsoft Debian Openvpn Debian Linux
6.0
CVSS 4.0 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
6.0 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.9 MEDIUM

Network-reachable authenticated race condition (PR:L, AC:H); server crash is primary impact (A:H) with minor freed-memory read exposure (C:L); no integrity or scope change.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 30, 2026 - 17:31 vuln.today
Analysis Generated
Jul 30, 2026 - 17:31 vuln.today
CVSS changed
Jul 30, 2026 - 17:22 NVD
6.0 (MEDIUM)
CVE Published
Jul 02, 2026 - 10:57 github-releases
MEDIUM 6.0
CVE Published
Jul 02, 2026 - 10:57 github-releases
UNKNOWN (no severity yet)

Description PRE-NVD

Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.

AnalysisAI

Use-after-free in OpenVPN's ack_write_buf() function allows an authenticated network client to crash the VPN server or potentially read freed heap memory by delivering a precisely-timed sequence of control channel and authentication packets. Affected releases span the 2.6.x and 2.7.x branches, with fixes shipping in v2.6.21 and v2.7.5 on July 1, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, and the AC:H/PR:L requirements materially limit realistic exploitation.

Technical ContextAI

OpenVPN's control channel handles key exchange, session negotiation, and acknowledgment buffering between peers. The vulnerability resides in ack_write_buf(), the function responsible for queuing acknowledgment packets within the control channel. A use-after-free (CWE-416 per description - though the NVD-assigned CWE is CWE-125, Out-of-bounds Read, likely reflecting the memory-read aspect of freed heap access) occurs when a race condition between the arrival of control channel packets and authentication packets causes ack_write_buf() to operate on already-freed memory. This freed-memory access can produce reads of stale heap content (explaining VC:L in the CVSS 4.0 vector) and, more reliably, corrupts process state leading to a server crash (VA:H). The bug was independently discovered by three researchers - 章鱼哥, Haiyang Huang, and Haruki Oyama - a convergence that suggests the code path is reachable via standard client behavior rather than requiring obscure protocol manipulation.

RemediationAI

Upgrade to OpenVPN v2.7.5 (2.7.x users) or v2.6.21 (2.6.x users), both released July 1, 2026 and available at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.5 and documented at https://community.openvpn.net/Security%20Announcements/CVE-2026-12996. Ubuntu system administrators should apply USN-8540-1 via standard package management. If immediate patching is operationally blocked, the most effective compensating control is to restrict which authenticated identities can reach the OpenVPN control channel - for example, enforcing strict certificate pinning and revoking certificates for any untrusted or external clients, reducing the population of principals capable of triggering the race. Rate-limiting or connection throttling at the network edge will not prevent exploitation since the timing window is within a single session, not across many connections. No configuration knob disables ack_write_buf() independently. These workarounds are partial mitigations only; patching remains the definitive fix.

More in Openvpn

View all
CVE-2018-7544 CRITICAL POC
9.1 Mar 16

A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
CVE-2017-7478 HIGH POC
7.5 May 15

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
CVE-2020-9442 HIGH POC
7.8 Feb 28

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
CVE-2018-9336 HIGH POC
7.8 May 01

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CVE-2017-5868 MEDIUM POC
6.1 May 26

CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
CVE-2014-9104 MEDIUM POC
6.8 Nov 26

Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
CVE-2023-46850 CRITICAL
9.8 Nov 11

Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
CVE-2019-25429 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
CVE-2019-25428 MEDIUM POC
6.1 Feb 19

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
CVE-2017-12166 CRITICAL
9.8 Oct 04

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
CVE-2024-1305 CRITICAL
9.8 Jul 08

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
CVE-2024-27903 CRITICAL
9.8 Jul 08

OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-51239 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy