CVE-2026-11604

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win version 2.0.0 through 2.8.3 allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122 CWE-131 CWE-787

Affected software

Vendor	Product	Versions
OpenVPN	ovpn-dco-win	>= 2.0.0, <= 2.5.8

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-11604Vendor Advisory
https://github.com/OpenVPN/ovpn-dco-win/releasesRelease Notes

Timeline

Published: Jun 10, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1160446.3A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of CVE-2026-1160454.3A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-design CVE-2026-1160465.3A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of t CVE-2026-1160474.3A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the CVE-2026-1160487.3A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulner CVE-2026-1160497.3A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the CVE-2026-116057.5The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, ev CVE-2026-1160507.3A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unk CVE-2026-1160524.3A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipul CVE-2026-1160535.3A weakness has been identified in dbcli mycli up to 2.29.4/2.30.1. The impacted element is the function source_special_command_is_safe of th CVE-2026-1160542.2A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação.CVE-2026-1160556.3A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/d