# cve.now: Openvpn

The newest entries naming Openvpn as an affected vendor (up to 200), of 56 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115402](https://cve.now/CVE-2026-115402.md): OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition… (CVSS 5.7)
- [CVE-2026-106017](https://cve.now/CVE-2026-106017.md): Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent extended key usage r (CVSS 6.3)
- [CVE-2026-84471](https://cve.now/CVE-2026-84471.md): The fix for CVE-2026-12996 was incomplete. (CVSS 7.2)
- [CVE-2026-105390](https://cve.now/CVE-2026-105390.md): Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers (CVSS 6.9)
- [CVE-2026-88964](https://cve.now/CVE-2026-88964.md): An integer underflow in OpenVPN version 2.7\_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia (CVSS 7.1)
- [CVE-2026-84790](https://cve.now/CVE-2026-84790.md): OpenVPN 2.7\_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field (CVSS 7.6)
- [CVE-2026-82325](https://cve.now/CVE-2026-82325.md): A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a sy (CVSS 6.8)
- [CVE-2026-84732](https://cve.now/CVE-2026-84732.md): Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via (CVSS 8.7)
- [CVE-2026-84256](https://cve.now/CVE-2026-84256.md): An argument parsing issue in OpenVPN 2.1\_rc10 through 2.6.22 and 2.7\_alpha1 through 2.7.7 on Windows allows remote authenticated users to ex (CVSS 7.7)
- [CVE-2026-84226](https://cve.now/CVE-2026-84226.md): OpenVPN version 2.5.0 through 2.6.22 and 2.7\_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting a (CVSS 8.5)
- [CVE-2026-82312](https://cve.now/CVE-2026-82312.md): OpenVPN 2.0.0 through 2.6.22 and 2.7\_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NUL (CVSS 1.8)
- [CVE-2026-81830](https://cve.now/CVE-2026-81830.md): The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directo (CVSS 5.6)
- [CVE-2026-81738](https://cve.now/CVE-2026-81738.md): OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-S (CVSS 2.3)
- [CVE-2026-78221](https://cve.now/CVE-2026-78221.md): An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7\_alpha1 through 2.7.6 allows local authenticated users (CVSS 5.9)
- [CVE-2026-78043](https://cve.now/CVE-2026-78043.md): The Windows Interactive Service in OpenVPN 2.7\_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration dir (CVSS 5.6)
- [CVE-2026-63650](https://cve.now/CVE-2026-63650.md): OpenVPN 2.7\_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 userna (CVSS 2.0)
- [CVE-2026-63649](https://cve.now/CVE-2026-63649.md): The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7\_alpha1 through 2.7.5 allows local authenticated users to bypass the (CVSS 4.1)
- [CVE-2026-12932](https://cve.now/CVE-2026-12932.md): A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers (CVSS 7.1)
- [CVE-2026-12996](https://cve.now/CVE-2026-12996.md): A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denia (CVSS 6.0)
- [CVE-2026-11771](https://cve.now/CVE-2026-11771.md): OpenVPN version 2.1.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authenti (CVSS 7.0)
- [CVE-2026-13117](https://cve.now/CVE-2026-13117.md): An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-fr (CVSS 6.0)
- [CVE-2026-13379](https://cve.now/CVE-2026-13379.md): The Windows interactive service in OpenVPN 2.7\_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a ser (CVSS 5.1)
- [CVE-2025-3110](https://cve.now/CVE-2025-3110.md): OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform H (CVSS 6.9)
- [CVE-2026-13122](https://cve.now/CVE-2026-13122.md): OpenVPN version 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authe (CVSS 5.9)
- [CVE-2026-13698](https://cve.now/CVE-2026-13698.md): A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers with a vali (CVSS 6.0)
- [CVE-2026-11604](https://cve.now/CVE-2026-11604.md): An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenti (CVSS 5.6)
- [CVE-2026-40215](https://cve.now/CVE-2026-40215.md): A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7\_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or (CVSS 6.1)
- [CVE-2026-35058](https://cve.now/CVE-2026-35058.md): Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7\_alpha1 through 2.7.1 allows (CVSS 6.9)
- [CVE-2026-9560](https://cve.now/CVE-2026-9560.md): Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands w (CVSS 9.4)
- [CVE-2026-2738](https://cve.now/CVE-2026-2738.md): Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer (CVSS 5.6)
- [CVE-2025-15497](https://cve.now/CVE-2025-15497.md): Insufficient epoch key slot processing in OpenVPN 2.7\_alpha1 through 2.7\_rc5 allows remote authenticated users to trigger an assert resultin (CVSS 3.8)
- [CVE-2025-13086](https://cve.now/CVE-2025-13086.md): Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7\_alpha1 through 2.7\_rc1 allows an attacker to open (CVSS 4.6)
- [CVE-2025-13751](https://cve.now/CVE-2025-13751.md): Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7\_alpha1 through 2.7\_rc2 on Windows allows a local authenticated use (CVSS 1.3)
- [CVE-2025-12106](https://cve.now/CVE-2025-12106.md): Insufficient argument validation in OpenVPN 2.7\_alpha1 through 2.7\_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP (CVSS 9.1)
- [CVE-2025-50055](https://cve.now/CVE-2025-50055.md): Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows con (CVSS 6.4)
- [CVE-2025-10680](https://cve.now/CVE-2025-10680.md): OpenVPN 2.7\_alpha1 through 2.7\_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variable (CVSS 8.8)
- [CVE-2025-50054](https://cve.now/CVE-2025-50054.md): Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too la (CVSS 5.5)
- [CVE-2025-3908](https://cve.now/CVE-2025-3908.md): The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arb (CVSS 6.2)
- [CVE-2024-4877](https://cve.now/CVE-2024-4877.md): OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI c (CVSS 8.8)
- [CVE-2025-2704](https://cve.now/CVE-2025-2704.md): OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting (CVSS 7.5)
- [CVE-2024-13454](https://cve.now/CVE-2024-13454.md): Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when (CVSS 5.3)
- [CVE-2024-5198](https://cve.now/CVE-2024-5198.md): OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the drive (CVSS 3.3)
- [CVE-2024-8474](https://cve.now/CVE-2024-8474.md): OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, (CVSS 7.5)
- [CVE-2024-5594](https://cve.now/CVE-2024-5594.md): OpenVPN before 2.6.11 does not santize PUSH\_REPLY messages properly which an attacker controlling the server can use to inject unexpected ar (CVSS 9.1)
- [CVE-2024-28882](https://cve.now/CVE-2024-28882.md): OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the vali (CVSS 4.3)
- [CVE-2024-1305](https://cve.now/CVE-2024-1305.md): tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use (CVSS 9.8)
- [CVE-2024-27903](https://cve.now/CVE-2024-27903.md): OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an… (CVSS 7.2)
- [CVE-2024-24974](https://cve.now/CVE-2024-24974.md): The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote… (CVSS 7.5)
- [CVE-2024-27459](https://cve.now/CVE-2024-27459.md): The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute a (CVSS 7.2)
- [CVE-2023-7235](https://cve.now/CVE-2023-7235.md): The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN b (CVSS 8.4)
- [CVE-2023-6247](https://cve.now/CVE-2023-6247.md): The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the appl (CVSS 6.5)
- [CVE-2023-7245](https://cve.now/CVE-2023-7245.md): The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to (CVSS 7.8)
- [CVE-2023-7224](https://cve.now/CVE-2023-7224.md): OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD\_INSER (CVSS 7.8)
- [CVE-2023-46850](https://cve.now/CVE-2023-46850.md): Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending net (no CVSS)
- [CVE-2023-46849](https://cve.now/CVE-2023-46849.md): Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero be (CVSS 7.5)
- [CVE-2022-3761](https://cve.now/CVE-2022-3761.md): OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to int (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openvpn
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.