Buffer Overflow Vulnerability in OpenVPN Software
CVE-2026-11604

5.6MEDIUM

Key Information:

Vendor

Openvpn
Status
Ovpn-dco-win
Vendor
CVE Published:
10 June 2026

What is CVE-2026-11604?

The OpenVPN Software, specifically the ovpn-dco-win version 2.0.0 through 2.8.3, contains a vulnerability due to improper calculation of buffer sizes in its epoch key generator. This flaw can be exploited by a remote authenticated peer who sends specially crafted data packets, leading to a heap-based buffer overflow and potential memory corruption within the kernel. If successfully executed, this could result in a system crash, effectively causing a denial of service.

Affected Version(s)

ovpn-dco-win Windows 2.0.0 <= 2.5.8

References

https://github.com/OpenVPN/ovpn-dco-win/releases
product
https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.