OpenVPN
by OpenVPN
Source repositories
CVEs (59)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-13751 | 0.00 | — | 0.00 | Dec 3, 2025 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service. | |||
| CVE-2025-12106 | 0.00 | — | 0.01 | Dec 1, 2025 | Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses | |||
| CVE-2025-50054 | 0.00 | — | 0.00 | Jun 20, 2025 | Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash | |||
| CVE-2025-3908 | 0.00 | — | 0.00 | May 19, 2025 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory. | |||
| CVE-2024-4877 | 0.00 | — | 0.00 | Apr 3, 2025 | OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges | |||
| CVE-2025-2704 | 0.00 | — | 0.01 | Apr 2, 2025 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase | |||
| CVE-2024-5198 | 0.00 | — | 0.00 | Jan 15, 2025 | OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt. | |||
| CVE-2024-8474 | 0.00 | — | 0.01 | Jan 6, 2025 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic | |||
| CVE-2024-5594 | 0.00 | — | 0.01 | Jan 6, 2025 | OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs. | |||
| CVE-2024-28882 | 0.00 | — | 0.01 | Jul 8, 2024 | OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session | |||
| CVE-2024-27459 | 0.00 | — | 0.08 | Jul 8, 2024 | The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges. | |||
| CVE-2023-7235 | 0.00 | — | 0.00 | Feb 21, 2024 | The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables. | |||
| CVE-2023-6247 | 0.00 | — | 0.01 | Feb 20, 2024 | The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing. | |||
| CVE-2023-7245 | 0.00 | — | 0.00 | Feb 20, 2024 | The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable | |||
| CVE-2023-7224 | 0.00 | — | 0.00 | Jan 8, 2024 | OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable | |||
| CVE-2023-46850 | 0.00 | — | 0.02 | Nov 11, 2023 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer. | |||
| CVE-2023-46849 | 0.00 | — | 0.01 | Nov 11, 2023 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service. | |||
| CVE-2022-3761 | 0.00 | — | 0.01 | Oct 17, 2023 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials | |||
| CVE-2020-20813 | 0.00 | — | 0.01 | Aug 22, 2023 | Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet. | |||
| CVE-2022-0547 | 0.00 | — | 0.04 | Mar 18, 2022 | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials. |
- CVE-2025-13751Dec 3, 2025risk 0.00cvss —epss 0.00
Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.
- CVE-2025-12106Dec 1, 2025risk 0.00cvss —epss 0.01
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
- CVE-2025-50054Jun 20, 2025risk 0.00cvss —epss 0.00
Buffer overflow in OpenVPN ovpn-dco-win version 1.3.0 and earlier and version 2.5.8 and earlier allows a local user process to send a too large control message buffer to the kernel driver resulting in a system crash
- CVE-2025-3908May 19, 2025risk 0.00cvss —epss 0.00
The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory which will change the ownership and permissions of that destination directory.
- CVE-2024-4877Apr 3, 2025risk 0.00cvss —epss 0.00
OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges
- CVE-2025-2704Apr 2, 2025risk 0.00cvss —epss 0.01
OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying network packets in the early handshake phase
- CVE-2024-5198Jan 15, 2025risk 0.00cvss —epss 0.00
OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.
- CVE-2024-8474Jan 6, 2025risk 0.00cvss —epss 0.01
OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
- CVE-2024-5594Jan 6, 2025risk 0.00cvss —epss 0.01
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
- CVE-2024-28882Jul 8, 2024risk 0.00cvss —epss 0.01
OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the validity of a closing session
- CVE-2024-27459Jul 8, 2024risk 0.00cvss —epss 0.08
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
- CVE-2023-7235Feb 21, 2024risk 0.00cvss —epss 0.00
The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path, which allows an attacker to replace binaries to run arbitrary executables.
- CVE-2023-6247Feb 20, 2024risk 0.00cvss —epss 0.01
The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the application crashing.
- CVE-2023-7245Feb 20, 2024risk 0.00cvss —epss 0.00
The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary code within the nodejs process context via the ELECTRON_RUN_AS_NODE environment variable
- CVE-2023-7224Jan 8, 2024risk 0.00cvss —epss 0.00
OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environment variable
- CVE-2023-46850Nov 11, 2023risk 0.00cvss —epss 0.02
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.
- CVE-2023-46849Nov 11, 2023risk 0.00cvss —epss 0.01
Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could cause an application crash, leading to a denial of service.
- CVE-2022-3761Oct 17, 2023risk 0.00cvss —epss 0.01
OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials
- CVE-2020-20813Aug 22, 2023risk 0.00cvss —epss 0.01
Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.
- CVE-2022-0547Mar 18, 2022risk 0.00cvss —epss 0.04
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
Page 2 of 3