CVE-2026-2738

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2738", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "state": "PUBLISHED", "assignerShortName": "OpenVPN", "dateReserved": "2026-02-19T10:23:29.009Z", "datePublished": "2026-02-19T20:00:30.951Z", "dateUpdated": "2026-02-20T20:00:31.699Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2026-02-19T20:00:30.951Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-131", "description": "CWE-131 Incorrect Calculation of Buffer Size", "type": "CWE"}]}], "affected": [{"vendor": "OpenVPN", "product": "ovpn-dco-win", "platforms": ["Windows"], "repo": "https://github.com/OpenVPN/ovpn-dco-win/", "versions": [{"status": "affected", "version": "2.8.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Buffer overflow in ovpn\u2011dco\u2011win\u202fversion 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet"}], "references": [{"url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-2738", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T20:00:11.476255Z", "id": "CVE-2026-2738", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:00:31.699Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2738", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T20:00:11.476255Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T20:00:25.332Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.6, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/OpenVPN/ovpn-dco-win/", "vendor": "OpenVPN", "product": "ovpn-dco-win", "versions": [{"status": "affected", "version": "2.8.0"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-2738", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Buffer overflow in ovpn\u2011dco\u2011win\u202fversion 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131 Incorrect Calculation of Buffer Size"}]}], "providerMetadata": {"orgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "shortName": "OpenVPN", "dateUpdated": "2026-02-19T20:00:30.951Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2738", "state": "PUBLISHED", "dateUpdated": "2026-02-20T20:00:31.699Z", "dateReserved": "2026-02-19T10:23:29.009Z", "assignerOrgId": "36a55730-e66d-4d39-8ca6-3c3b3017965e", "datePublished": "2026-02-19T20:00:30.951Z", "assignerShortName": "OpenVPN"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "ovpn-dco-win", "repo": "https://github.com/OpenVPN/ovpn-dco-win/", "vendor": "OpenVPN", "versions": [{"status": "affected", "version": "2.8.0"}]}], "source": "security@openvpn.net"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in ovpn\u2011dco\u2011win\u202fversion 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet"}, {"lang": "es", "value": "Desbordamiento de b\u00fafer en ovpn?dco?win versi\u00f3n 2.8.0 permite a atacantes locales provocar una ca\u00edda del sistema al enviar paquetes demasiado grandes al par remoto cuando la etiqueta AEAD se encuentra al final del paquete cifrado."}], "id": "CVE-2026-2738", "lastModified": "2026-06-17T10:31:37.897", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@openvpn.net", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2738", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T20:00:11.476255Z", "version": "2.0.3"}}]}, "published": "2026-02-19T21:18:33.773", "references": [{"source": "security@openvpn.net", "url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-2738"}], "sourceIdentifier": "security@openvpn.net", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-131"}], "source": "security@openvpn.net", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["windows"], "status": "affected", "versions": {"scheme": "semver", "value": "2.8.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ovpn-dco-win", "source": "cna", "vendor": "OpenVPN"}, "product": "ovpn-dco-win", "vendor": "openvpn"}], "analysis": {"en": {"generated_at": "2026-04-17T17:55:12.370675+00:00", "value": {"mitigation_remediation": ["Update the OpenVPN DCO Windows client to the latest available version (at least 2.8.1 or newer) where the overflow has been patched.", "If upgrading cannot be performed immediately, apply network filtering to limit packet sizes or block packets that contain the AEAD tag at an unexpected position, thereby preventing the overflow from occurring.", "Monitor system and application logs for unexpected crashes and consider disabling the DCO feature until a patch is applied."], "summary": {"action": "Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the OpenVPN DCO Windows client, specifically version\u202f2.8.0. The issue is present on Windows operating systems that run this client and may impact any users who are both sending and receiving encrypted traffic through the affected version.", "description_and_impact": "A buffer overflow exists in the Windows DCO client of OpenVPN when processing encrypted packets that place the AEAD tag at the end. Local attackers can send oversized packets to trigger the overflow, resulting in a system crash. The flaw is classified as CWE\u2011131 and leads solely to denial of service by terminating the client application. No remote code execution or confidentiality compromise is possible.", "risk_and_exploitability": "The CVSS score of 5.6 indicates moderate risk, but the EPSS score is reported as less than 1\u202f%, meaning exploitation probability is very low in the current ecosystem. The vulnerability has not been listed in the DOD KEV catalog. Attackers need local access or the ability to send packets to the target client, and the attack does not allow escalation or data exfiltration. The primary concern is a crash of the client application, which could disrupt operations but offers no further privilege gain."}}}}, "created": "2026-02-20T09:54:08.009352+00:00", "title": "Buffer Overflow Causing Crash in OpenVPN DCO Windows Client via Oversized AEAD Packets", "updated": "2026-04-17T18:00:12.183404+00:00", "vendors": ["openvpn", "openvpn$PRODUCT$ovpn-dco-win"]}