CVE-2025-12106

Published: Dec 1, 2025Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Affected (8)

Products: Openvpn: Openvpn

Openvpn

1 product

Openvpn

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Openvpn Openvpn	Version 2.6.13
Openvpn Openvpn	Version 2.7 alpha1
Openvpn Openvpn	Version 2.7 alpha2
Openvpn Openvpn	Version 2.7 alpha3
Openvpn Openvpn	Version 2.7 beta1
Openvpn Openvpn	Version 2.7 beta2
Openvpn Openvpn	Version 2.7 beta3
Openvpn Openvpn	Version 2.7 rc1

Related CWEs

CWE-126

Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

References (2)

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106

Source: security@openvpn.net

Vendor Advisory

https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html

Source: security@openvpn.net

Mailing List

Timeline

No history available yet.