CVE-2026-115402 in ovpn-dco-win
Summary
by MITRE • 10/28/2026
OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash) via a race condition in the TCP connect path.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within OpenVPN's Windows Data Channel Offload driver, specifically affecting versions from ovpn-dco-win 0.6.5 through 2.8.13, represents a critical security flaw rooted in improper synchronization mechanisms during network connection establishment. This defect manifests as a race condition located within the TCP connect path of the kernel-mode driver responsible for offloading data plane operations to improve performance on Windows systems. The core technical issue arises when multiple threads or processes attempt to interact with the same internal state structures associated with an incoming TCP connection without adequate locking mechanisms, leading to inconsistent memory states and subsequent system instability.
From a technical perspective, this race condition allows unprivileged local users to trigger a denial of service by manipulating the timing of packet processing operations. When a user initiates or interacts with network connections in rapid succession, the driver fails to properly serialize access to critical resources such as connection context blocks or socket structures. This lack of atomicity results in use-after-free scenarios or null pointer dereferences within the kernel space. Because the vulnerability resides in a kernel-mode component, the consequences are severe and immediate, typically resulting in a system crash known as a Blue Screen of Death on Windows operating systems. The attacker does not require administrative privileges to exploit this flaw, significantly lowering the barrier for entry and increasing the potential attack surface among standard user accounts.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. An successful exploitation leads to an immediate system crash, causing a complete loss of service for all applications running on the affected machine. In enterprise environments where OpenVPN serves as a critical component for remote access and secure tunneling, such instability can disrupt business continuity, block employee productivity, and potentially expose sensitive data if encryption sessions are abruptly terminated without proper cleanup procedures. Furthermore, repeated crashes may lead to system unreliability that necessitates frequent reboots, increasing maintenance overhead and reducing trust in the infrastructure's resilience against local threats.
This vulnerability aligns with CWE-362, which describes concurrent execution access with insufficient synchronization, a common class of defects in systems programming where race conditions occur due to missing or incorrect locking mechanisms. Additionally, from an offensive security perspective, this flaw maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique of resource exhaustion via kernel-level instability. While typically categorized as a denial-of-service vector rather than a privilege escalation path in its current form, such race conditions can sometimes be chained with other vulnerabilities to achieve higher levels of compromise if additional exploitation vectors are present within the same driver architecture.
Mitigation strategies for this vulnerability involve immediate patching of the OpenVPN client and server components on Windows endpoints to versions that include fixes for the ovpn-dco-win driver synchronization issues. Organizations should prioritize updating all affected systems to version 2.8.14 or later, where these race conditions have been addressed through improved locking granularity and state validation checks within the TCP connect path. In environments where immediate patching is not feasible due to operational constraints, network segmentation can help isolate vulnerable hosts from critical resources, reducing the blast radius of a potential system crash. Additionally, implementing strict endpoint detection and response policies that monitor for abnormal kernel-level crashes or driver behavior may aid in early detection of exploitation attempts before they result in widespread service disruption. Regular vulnerability scanning focused on installed software versions is also recommended to ensure timely identification and remediation of such defects across the enterprise landscape.