Openvpn vulnerabilities, page 5
98 vulnerabilities
Known vulnerabilities in Openvpn products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 18 products.
CVE-2026-9560openvpn incopenvpn connect+1
EPSS score0.38%
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channelCVE-2026-81830ubuntuopenvpn+1EPSS score0.15%
The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validationCVE-2026-81738ubuntuopenvpn+1EPSS score0.33%
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entriesCVE-2026-78043ubuntuopenvpn+1EPSS score0.17%
The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted pathsCVE-2026-78221ubuntuopenvpn+1EPSS score0.12%
An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.CVE-2026-12996alpineopenvpn+4EPSS score0.81%
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiryCVE-2026-12932alpineopenvpn+3EPSS score0.75%
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service (memory exhaustion) via a flood of crafted packetsCVE-2026-82312ubuntuopenvpn+1EPSS score0.10%
OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objectsCVE-2026-82325openvpnovpn-dco-winEPSS score0.14%
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messagesCVE-2026-35058alpineopenvpn+3EPSS score0.60%
Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.CVE-2023-7224openvpnconnect+1EPSS score0.24%
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variableCVE-2023-7235chainguardopenvpn+3EPSS score0.21%
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.CVE-2023-7245openvpnconnect+1EPSS score0.32%
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variableCVE-2023-46849alpineopenvpn+8EPSS score1.15%
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.CVE-2023-46850alpineopenvpn+8EPSS score2.00%
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.CVE-2023-6247openvpnopenvpn_3+1EPSS score0.78%
The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing.CVE-2006-2229debianopenvpn+2EPSS score1.35%
OpenVPN 2.0.7 and earlier, when configured to use the --management option with an IP that is not 127.0.0.1, uses a cleartext password for TCP sessions to the management interface, which might allow remote attackers to view sensitive information or cause a denial of service.CVE-2006-1629debianopenvpn+2EPSS score3.09%
OpenVPN 2.0 through 2.0.5 allows remote malicious servers to execute arbitrary code on the client by using setenv with the LD_PRELOAD environment variable.