CVE-2026-11604
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In OpenVPN ovpn-dco-win versions 2.0.0 through 2.8.3, an incorrect buffer size calculation in the epoch key generator allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, causing a system crash.
Risk Assessment
An attacker can cause a denial of service (DoS) by crashing or rebooting the target system.
Recommendation
Update the ovpn-dco-win driver to version 2.8.4 or later.
Other vulnerabilities in OpenVPN ovpn-dco-win
See all- CVE-2026-115402Medium
OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 allow unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
- CVE-2026-105390Medium
Improper synchronization in OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
- CVE-2026-82325Medium
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver versions 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages.
Original NVD description (English source)
An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS