Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-12106 EUVD-2025-199988GHSA-xg3m-85r2-236x

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing I…

Published Dec 1, 2025 · Updated Dec 1, 2025 · Assigned by OpenVPN

Vendor: OpenVPN Product: OpenVPN

Description

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Affected products

VendorProductAffectedFixed
OpenVPN OpenVPN 2.7_alpha1 – ≤ 2.7_rc1 —

Advisories 1

References