CVE Catalog
CVE-2026-13379
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.29%
21th percentile - higher than 21% of all known CVEs
Summary
The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.
Risk Assessment
An attacker can disrupt DNS resolution or crash the OpenVPN service, affecting VPN availability.
Recommendation
Upgrade OpenVPN to version 2.7.5 or later if available.
Original NVD description (English source)
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process