CVE-2025-13751

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-03 · updated 2026-06-17
Weakness: CWE-770

Description

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

Affected products

OpenVPN: from 2.5.0 before 2.6.17; 2.7-alpha1, 2.7-alpha2, 2.7-alpha3, 2.7-beta1, 2.7-beta2, 2.7-beta3 (+2) — fixed in 2.6.17

How to fix

Upgrade to a fixed version: OpenVPN 2.6.17. Check the vendor advisory for mitigations.

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-13751
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00153.html
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00154.html

Get alerted when CVE-2025-13751 or the next vulnerability affects your stack