Buffer Overflow in OpenVPN DCO for Windows Affects Local Systems
CVE-2026-2738

5.6MEDIUM

Key Information:

Vendor

Openvpn
Status
Ovpn-dco-win
Vendor
CVE Published:
19 February 2026

What is CVE-2026-2738?

A buffer overflow vulnerability in the ovpn-dco-win version 2.8.0 allows local attackers to manipulate packet sizes, leading to potential system crashes. Specifically, this vulnerability can be exploited by sending oversized packets to the remote peer, particularly when the AEAD tag appears at the end of the encrypted packet, posing serious risks to network reliability and security.

Affected Version(s)

ovpn-dco-win Windows 2.8.0

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.