PT-2026-56044 · Openvpn · Openvpn

Published 2026-07-01 · Updated 2026-07-10 · CVE-2026-13117

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenVPN (affected versions not specified)

Description A use-after-free issue exists in the check session buf not used() function within the tls-crypt-v2 mechanism and the tls wrap reneg function. A remote attacker could exploit this to cause a denial of service or execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2026-09237

CVE-2026-13117

Affected Products

Openvpn

References · 10

• https://bdu.fstec.ru/vul/2026-09237 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-13117 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-13117 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-13117 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-13117 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-13117 · Security Note
• https://explore.alas.aws.amazon.com/CVE-2026-13117.html · Note
• https://community.openvpn.net/Downloads · Note
• https://twitter.com/cryptostorm_is/status/2075573773399416997 · Twitter Post
• https://undercodetesting.com/cve-2026-13117-openvpns-tls-crypt-v2-heap-use-after-free-how-a-single-blind-spot-in-a-safety-check-opens-the-door-to-rce-video · Note