Use-after-free in OpenVPN Server - CVE-2026-12996

Vulnerability identifier: #VU139870

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-12996

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in ack_write_buf() when processing a well-timed sequence of control channel and authentication packets. A remote attacker can send a specially crafted packet sequence to cause a denial of service.

OpenVPN Server
Debian Linux
openEuler
Ubuntu
openvpn-help
openvpn-devel
openvpn-debugsource
openvpn-debuginfo
openvpn
openvpn (Ubuntu package)
openvpn (Debian package)

Install security update from vendor's website.

OpenVPN Server - addressed in versions 2.6.21, 2.7.5
openvpn-help - addressed in versions 2.4.8-14, 2.5.5-10, 2.6.9-8
openvpn-devel - addressed in versions 2.4.8-14, 2.5.5-10, 2.6.9-8
openvpn-debugsource - addressed in versions 2.4.8-14, 2.5.5-10, 2.6.9-8
openvpn-debuginfo - addressed in versions 2.4.8-14, 2.5.5-10, 2.6.9-8
openvpn - addressed in versions 2.4.8-14, 2.5.5-10, 2.6.9-8
openvpn (Ubuntu package) - addressed in versions 2.5.11-0ubuntu0.22.04.4, 2.6.19-0ubuntu0.24.04.3, 2.7.0-1ubuntu1.2
openvpn (Debian package) - update to 2.6.14-1+deb13u3

• https://github.com/OpenVPN/openvpn/releases/tag/v2.6.21
• https://github.com/OpenVPN/openvpn/commit/4dee614e4e799d6d4a20bffabd902291c86406f2

• Multiple vulnerabilities in OpenVPN Server
• Debian update for openvpn
• openEuler 24.03 LTS SP1 update for openvpn
• openEuler 24.03 LTS SP3 update for openvpn
• openEuler 24.03 LTS SP4 update for openvpn
• Ubuntu update for openvpn
• openEuler 22.03 LTS SP4 update for openvpn
• openEuler 20.03 LTS SP4 update for openvpn