CVE-2026-11604

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-09-24
Weakness: CWE-122

Description

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

Affected products

OpenVPN ovpn-dco-win: from 2.0.0 through 2.8.3

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-11604
https://github.com/OpenVPN/ovpn-dco-win/releases

Get alerted when CVE-2026-11604 or the next vulnerability affects your stack