{"id":"CVE-2026-115402","kind":"vulnerability","aliases":["CVE-2026-115402"],"related":[],"title":"OpenVPN ovpn-dco-win: local users can crash Windows via TCP race","description":"OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.","summary":"OpenVPN's ovpn-dco-win Windows driver has a race condition in its TCP connect path. A local user without special privileges can trigger it and crash the system.","severity":"medium","cvss":5.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","openvpn","vpn-clients","vpn-servers","windows"],"not_affected_if":["no-dco-driver","non-windows"],"how_to_check":"- Check the installed ovpn-dco-win driver version on Windows against the affected range `0.6.5` through `2.8.13`\n- Confirm whether the OpenVPN data-channel offload (DCO) driver is installed on the host","fix":"- Update ovpn-dco-win to a release newer than `2.8.13`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-10-28T15:17:04+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","triaged_at":"2026-10-28T15:35:05+00:00","updated_at":"2026-10-28T15:35:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T15:35:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update ovpn-dco-win to a release newer than `2.8.13`; the exact fixed version is unknown from the sources","reach":"local","title":"OpenVPN ovpn-dco-win: local users can crash Windows via TCP race","impact":"medium","summary":"OpenVPN's ovpn-dco-win Windows driver has a race condition in its TCP connect path. A local user without special privileges can trigger it and crash the system.","category":"infrastructure","nicknames":[],"who_cares":["openvpn","windows","vpn-servers","vpn-clients"],"confidence":0.6,"needs_auth":"yes","worst_case":"local unprivileged user crashes the whole Windows system","analyst_note":"Confirm the fixed ovpn-dco-win version and whether the TCP connect path is used in default OpenVPN configurations, using the NVD entry and OpenVPN's advisory.","how_to_check":"- Check the installed ovpn-dco-win driver version on Windows against the affected range `0.6.5` through `2.8.13`\n- Confirm whether the OpenVPN data-channel offload (DCO) driver is installed on the host","needs_analyst":true,"not_affected_if":["no-dco-driver","non-windows"],"who_is_affected":"Windows hosts running the OpenVPN ovpn-dco-win driver in the affected version range, where local users can log on. Systems without the DCO driver installed are not affected. The sources do not say whether the bug needs a non-default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000607,"input_tokens":3296,"output_tokens":554,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115402':16A,19A '-2026':15A,18A '0.6.5':64C '2.8.13':66C 'allow':67C 'caus':72C 'client':24B 'condit':40B,82C 'connect':44B,86C 'crash':9A,56B,78C 'cve':14A,17A 'dco':4A,33B,62C 'denial':74C 'driver':36B 'infrastructur':20B 'local':6A,47B,69C 'openvpn':1A,21B,29B,59C 'ovpn':3A,32B,61C 'ovpn-dco-win':2A,31B,60C 'path':45B,87C 'privileg':51B 'race':13A,39B,81C 'server':27B 'servic':76C 'special':50B 'system':58B,77C 'tcp':12A,43B,85C 'trigger':53B 'unprivileg':68C 'user':7A,48B,70C 'via':11A,79C 'vpn':23B,26B 'vpn-client':22B 'vpn-server':25B 'win':5A,34B,63C 'window':10A,28B,35B 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Windows hosts running the OpenVPN ovpn-dco-win driver in the affected version range, where local users can log on. Systems without the DCO driver installed are not affected. The sources do not say whether the bug needs a non-default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T15:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@openvpn.net","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115402","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115402","severity":null,"published_at":"2026-10-28T15:17:04+00:00","modified_at":"2026-10-28T15:24:42+00:00","first_seen_at":"2026-10-28T15:33:37+00:00","fetched_at":"2026-10-28T15:33:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}