CVE-2026-11604

MediumCVSS 6.5

Published: 10/06/2026(UTC)Updated: 24/09/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

24th percentile - higher than 24% of all known CVEs

Summary

In OpenVPN ovpn-dco-win versions 2.0.0 through 2.8.3, an incorrect buffer size calculation in the epoch key generator allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, causing a system crash.

Risk Assessment

An attacker can cause a denial of service (DoS) by crashing or rebooting the target system.

Recommendation

Update the ovpn-dco-win driver to version 2.8.4 or later.

Other vulnerabilities in OpenVPN ovpn-dco-win

CVE-2026-82325Medium
A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver versions 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages.

Original NVD description (English source)

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS