CVE-2024-27903
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, allowing an attacker to load an arbitrary plug-in that can interact with the privileged OpenVPN interactive service.
Risk Assessment
An attacker could use a malicious plug-in to interact with the privileged service, potentially leading to code execution or privilege escalation on Windows.
Recommendation
Update OpenVPN to a version later than 2.6.9 and restrict permissions on directories from which plug-ins can be loaded.
Other vulnerabilities in OpenVPN
See all- CVE-2017-7520High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.
- CVE-2017-7508High
OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.
- CVE-2017-7478High
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.
- CVE-2026-13379Critical
The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.
- CVE-2025-12106Critical
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.
- CVE-2024-24974High
In OpenVPN 2.6.9 and earlier, the interactive service allows the OpenVPN service pipe to be accessed remotely. This allows a remote attacker to interact with the privileged OpenVPN interactive service.
- CVE-2023-46850Critical
OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.
- CVE-2017-12166Critical
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.
- CVE-2026-84471High
Incomplete fix for CVE-2026-12996. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.
- CVE-2026-88964High
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.
Original NVD description (English source)
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can be used to interact with the privileged OpenVPN interactive service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS