EUVD-2026-72278
Stack-based Buffer Overflow (CWE-121)
2026-09-03
GHSA-7xfh-h474-9hf7
GHSA-7xfh-h474-9hf7
2.3
CVSS 4.0 · Vendor
Severity by source
Vendor (CNA)
PRIMARY
2.3
LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today
AI
4.7
MEDIUM
Network-delivered but requires attacker server positioning (AC:H) and passive user interaction (UI:R); downstream NRPT impact maps to S:C with no confidentiality exposure.
3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L
Primary rating from Vendor (CNA).
CVSS VectorVendor
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
P
Scope
X
Lifecycle Timeline
5
Metadata Corrected
Sep 07, 2026 - 08:40 vuln.today
tag: Microsoft
replaced by Openvpn
Source Code Evidence Fetched
Sep 07, 2026 - 08:26 vuln.today
Analysis Generated
Sep 07, 2026 - 08:26 vuln.today
CVE Published
Sep 03, 2026 - 18:09 github-releases
LOW 2.3
CVE Published
Sep 03, 2026 - 18:09 github-releases
UNKNOWN (no severity yet)
Description PRE-NVD
Disclosed via GitHub release of openvpn/openvpn. NVD scoring and full description are pending.
AnalysisAI
Stack-based buffer overflow in OpenVPN's Windows service component (openvpnserv) affects versions 2.5.0 through 2.7.6, requiring high attack complexity and passive user interaction to trigger. The flaw produces limited integrity and availability impact on the vulnerable Windows system and marginally on downstream systems in the VPN path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target to run OpenVPN in Windows service mode (openvpnserv) on a version between 2.5.0 and 2.7.6, and to establish a VPN session with a server that delivers IDN domains with UTF-8 encoding via NRPT push. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 2.3 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L) accurately conveys a difficult-to-exploit, low-impact finding - even a mid-sized municipal IT team in gniezno managing a fleet of remote-access VPN endpoints should treat this as a routine patch-window item rather than an emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade OpenVPN to version 2.7.7 or later, confirmed as the patched release via GitHub at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.7 and the vendor advisory at https://community.openvpn.net/Security%20Announcements/CVE-2026-81738. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).