Executive brief
A vulnerability exists in the OpenVPN Data Channel Offload (DCO) driver for Windows, which is used to speed up VPN connections. An authenticated user could send a specially crafted data packet that causes the Windows kernel to crash. This results in a blue screen of death (BSOD) and a complete system restart, disrupting all operations on the affected machine.
Technical details
The vulnerability is a heap-based buffer overflow (CWE-122) caused by an incorrect buffer size calculation (CWE-131) within the epoch key generator of the ovpn-dco-win driver. The flaw exists in versions 2.0.0 through 2.8.3. A remote authenticated peer can exploit this by sending a specifically crafted data packet over the VPN tunnel. Because the driver operates in kernel mode, the resulting out-of-bounds write (CWE-787) leads to kernel memory corruption and an immediate system crash (BSOD). While the CVSS 4.0 score provided by the CNA is 5.6 (Medium) due to local/authenticated requirements, the impact is a complete loss of availability for the host system.
Affected products
- OpenVPN ovpn-dco-win 2.0.0 through 2.8.3
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory