PT-2026-66521 · Openvpn · Openvpn

CVE-2026-13379 · Published 2026-07-30 · Updated 2026-07-30

Mitre

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:N/VA:L/SC:H/SI:N/SA:H

The Windows interactive service in OpenVPN 2.7 alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-142

Related Identifiers

CVE-2026-13379

Affected Products

Openvpn

References · 3

• https://community.openvpn.net/Security%20Announcements/CVE-2026-13379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-13379 · Security Note
• https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026 · Note