Improper Synchronization in OpenVPN OVPN-DCO for Windows by OpenVPN
CVE-2026-105390

6.9MEDIUM

Key Information:

Vendor

Openvpn
Status
Ovpn-dco-win
Vendor
CVE Published:
13 October 2026

What is CVE-2026-105390?

A vulnerability exists in the OpenVPN OVPN-DCO for Windows due to improper synchronization. This flaw allows local attackers to create a deadlock condition by sending a specially crafted write to the ovpn-dco device. As a result, the host may become unresponsive, which could lead to potential disruptions in service or functionality. Users and administrators are advised to review the advisory and apply necessary updates to mitigate the risk.

Affected Version(s)

ovpn-dco-win Windows 0.6.5 <= 1.3.5

ovpn-dco-win Windows 2.4.0 <= 2.8.7

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.