Live › vulnerability › CVE-2026-115402
Go to dashboardOpenVPN's ovpn-dco-win Windows driver has a race condition in its TCP connect path. A local user without special privileges can trigger it and crash the system.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 15:33 UTC. All times on this page are UTC.
Windows hosts running the OpenVPN ovpn-dco-win driver in the affected version range, where local users can log on. Systems without the DCO driver installed are not affected. The sources do not say whether the bug needs a non-default configuration.
No product ranges from the sources yet.
0.6.5 through 2.8.132.8.13; the exact fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
This page as .md · .json · in your agent: get_signal("CVE-2026-115402")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.