CVE-2026-82325

MediumCVSS 6.8

Published: 07/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 07/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver versions 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages.

Risk Assessment

The risk includes the possibility of a local denial of service by an authenticated user, potentially disrupting services.

Recommendation

It is recommended to update the ovpn-dco-win driver to a version newer than 2.8.6 that includes the fix.

Other vulnerabilities in OpenVPN ovpn-dco-win

CVE-2026-11604Medium
In OpenVPN ovpn-dco-win versions 2.0.0 through 2.8.3, an incorrect buffer size calculation in the epoch key generator allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, causing a system crash.

Original NVD description (English source)

A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a system crash via crafted control messages

Vulnerability data from NVD (NIST) · CISA KEV · EPSS