CVE-2026-105390: OpenVPN ovpn-dco-win vulnerability

Q: What access does an attacker need to exploit this issue?

The issue is described as locally exploitable. An attacker needs the ability to perform a crafted write to the ovpn-dco device.

Q: Is remote exploitation described?

No remote attack path is identified in the available information. The reported attack requires local access to the affected host.

Published Oct 13, 2026

Updated

Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

Affected Software

1 affected component

OpenVPN ovpn-dco-win>=0.6.5<=1.3.5, >=2.4.0<=2.8.7

Event History

Oct 13, 2026

CVE Published

via MITRE·10:44 PM

Data Sourced

via MITRE·10:44 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue is described as locally exploitable. An attacker needs the ability to perform a crafted write to the ovpn-dco device.

Is remote exploitation described?

No remote attack path is identified in the available information. The reported attack requires local access to the affected host.