CVE search · CVE-2025-12106

CVE-2025-12106

critical 9.1

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Open in the NVD CVE.org JSON

Status: Analyzed
Published: 2025-12-01
Last changed: 2026-09-26
Source: security@openvpn.net
Weakness: CWE-126

Severity

Version	Score	Vector	Source
CVSS 3.1	critical 9.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H`	134c704f-9b21-4f2e-91b3-4a467353bcc0Secondary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

openvpn · openvpn

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106Vendor Advisory
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.htmlMailing List

CVE-2025-12106

Details

Severity

Affected products

References