OpenVPN vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-84471 The fix for CVE-2026-12996 was incomplete.High 7.2 · Oct 14, 2026
• CVE-2026-88964 An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memoHigh 7.1 · Oct 13, 2026
• CVE-2026-84790 OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject fieldHigh 7.6 · Oct 13, 2026
• CVE-2026-84732 Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs thatHigh 8.7 · Sep 7, 2026
• CVE-2026-84256 An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to execute arbitrary commHigh 7.7 · Sep 7, 2026
• CVE-2026-84226 OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting attack during networkHigh 8.5 · Sep 7, 2026
• CVE-2026-12932 A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial oHigh 7.1 · Jul 30, 2026
• CVE-2026-11771 OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentiallHigh 7 · Jul 30, 2026
• CVE-2026-9560 Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileCritical 9.4 · May 26, 2026
• CVE-2025-12106 Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addressesCritical 9.1 · Dec 1, 2025
• CVE-2025-10680 OpenVPN 2.7_alpha1 through 2.7_beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown High 8.8 · Oct 24, 2025
• CVE-2024-4877 OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would conneHigh 8.8 · Apr 3, 2025
• CVE-2025-2704 OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying networHigh 7.5 · Apr 2, 2025
• CVE-2024-8474 OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorizeHigh 7.5 · Jan 6, 2025
• CVE-2024-5594 OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending Critical 9.1 · Jan 6, 2025
• CVE-2024-1305 tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory Critical 9.8 · Jul 8, 2024
• CVE-2024-27903 OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker to load an arbitrary plug-in which can bCritical 9.8 · Jul 8, 2024
• CVE-2024-27459 The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with mHigh 7.8 · Jul 8, 2024
• CVE-2024-24974 The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to be accessed remotely, which allows a remote attacker to interact with thHigh 7.5 · Jul 8, 2024
• CVE-2023-7235 The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN binaries when using aHigh 8.4 · Feb 21, 2024
• CVE-2023-7245 The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to execute arbitrary coHigh 7.8 · Feb 20, 2024
• CVE-2023-7224 OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD_INSERT_LIBRARIES environmHigh 7.8 · Jan 8, 2024
• CVE-2023-46850 Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a reCritical 9.8 · Nov 10, 2023
• CVE-2023-46849 Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could High 7.5 · Nov 10, 2023
• CVE-2020-20813 Control Channel in OpenVPN 2.4.7 and earlier allows remote attackers to cause a denial of service via crafted reset packet.High 7.5 · Aug 22, 2023