CVE-2025-12106

9.1 criticalEPSS 0.6%

Critical (9.1) in openvpn openvpn. EPSS 0.6% chance of exploitation in the next 30 days.

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Severity

CVSS 3.1

9.1 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-126
Published: 2025-12-01
Modified: 2026-09-26
Record from: the NVD, synced 2026-10-19

Affected

openvpn:openvpn

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106
https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html

Check your stack JSON