# CVE-2026-11604: OpenVPN ovpn-dco-win heap overflow in epoch key generator

Source: https://junglewise.ai/threats/cve-2026-11604-openvpn-ovpn-dco-win-heap-overflow-in-epoch-key-generator  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-11604 · Severity: info · CVSS 5.6 · Published 2026-06-10

A vulnerability exists in the OpenVPN Data Channel Offload (DCO) driver for Windows, which is used to speed up VPN connections. An authenticated user could send a specially crafted data packet that causes the Windows kernel to crash. This results in a blue screen of death (BSOD) and a complete system restart, disrupting all operations on the affected machine.

Technologies: [Openvpn Ovpn-Dco-Win](https://junglewise.ai/threats/technologies/ovpn-dco-win). Vendors: [Openvpn](https://junglewise.ai/threats/vendors/openvpn).

## Quick answers

**Is CVE-2026-11604 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11604 being exploited in the wild.

**How severe is CVE-2026-11604?** Informational severity, with a CVSS score of 5.6, published 10 June 2026.

**Which products and versions are affected?** Openvpn Ovpn-Dco-Win 2.0.0 through 2.8.3.

**Is there a fix for CVE-2026-11604?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11604 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-11604?** Check whether you run Openvpn Ovpn-Dco-Win at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) caused by an incorrect buffer size calculation (CWE-131) within the epoch key generator of the ovpn-dco-win driver. The flaw exists in versions 2.0.0 through 2.8.3. A remote authenticated peer can exploit this by sending a specifically crafted data packet over the VPN tunnel. Because the driver operates in kernel mode, the resulting out-of-bounds write (CWE-787) leads to kernel memory corruption and an immediate system crash (BSOD). While the CVSS 4.0 score provided by the CNA is 5.6 (Medium) due to local/authenticated requirements, the impact is a complete loss of availability for the host system.

## Affected products

- OpenVPN ovpn-dco-win 2.0.0 through 2.8.3

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://community.openvpn.net/Security%20Announcements/CVE-2026-11604](https://community.openvpn.net/Security%20Announcements/CVE-2026-11604)
- [https://github.com/OpenVPN/ovpn-dco-win/releases](https://github.com/OpenVPN/ovpn-dco-win/releases)

## Related threats

- [OpenVPN ovpn-dco-win race condition denial of service](https://junglewise.ai/threats/cve-2026-115402-openvpn-ovpn-dco-win-0-6-5-through-2-8-13-allows-unprivileged)
- [OpenVPN ovpn-dco-win synchronization deadlock](https://junglewise.ai/threats/cve-2026-105390-improper-synchronization-in-the-openvpn-ovpn-dco-win-for-windows)
- [OpenVPN ovpn-dco-win use-after-free in driver](https://junglewise.ai/threats/cve-2026-82325-openvpn-ovpn-dco-win-use-after-free-in-driver)