CVE-2025-13751

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770 CWE-775 CWE-841

Affected software

Vendor	Product	Versions
OpenVPN	OpenVPN	>= 2.5.0, <= 2.6.16; >= 2.7_alpha1, <= 2.7_rc2

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-13751Vendor Advisory
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00153.htmlMailing List, Release Notes
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00154.htmlMailing List, Release Notes

Timeline

Published: Dec 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-137534.3The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect CVE-2025-137545.3The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Sensitive Information Exposure CVE-2025-137555.5IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensit CVE-2025-137564.3The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on th CVE-2025-137578.8SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.CVE-2025-137583.5Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.CVE-2025-13764.7A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library CVE-2025-137619.6GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowe CVE-2025-137624.8Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when try CVE-2025-137635.7Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack req CVE-2025-137649.8The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the CVE-2025-137654.3Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: be