Quick answers
- Is CVE-2026-115402 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-115402 being exploited in the wild.
- How severe is CVE-2026-115402?
- Informational severity, published 28 October 2026.
- Which products and versions are affected?
- Openvpn Ovpn-Dco-Win 1.5.8 through 2.8.13.
- Is there a fix for CVE-2026-115402?
- Yes: fixed in ovpn-dco-win 2.8.14 (shipped with OpenVPN 2.7.8-I002). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-115402 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-115402?
- Check whether you run Openvpn Ovpn-Dco-Win at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: ovpn-dco-win 2.8.14 (shipped with OpenVPN 2.7.8-I002)
Technical details
The ovpn-dco-win kernel driver fails to hold a reference to a socket during TCP connect operations, allowing concurrent teardown to close the socket while Windows Sockets Kernel (WSK) is still using it. This leads to either double-completion of the connect request or use-after-free, triggering a kernel bug check. The vulnerability requires local access but no privileges.
Affected products
- OpenVPN ovpn-dco-win 1.5.8 through 2.8.13
Timeline
- 2026-10-28: disclosed