Out-of-bounds write in OpenVPN Server - CVE-2026-11771

Vulnerability identifier: #VU139874

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-11771

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds write in NTLMv2 proxy responses when parsing response data. A remote attacker can send specially crafted response data to cause a denial of service.

The advisory describes the overrun as limited to one byte.

OpenVPN Server
Debian Linux
Ubuntu
openEuler
openvpn (Ubuntu package)
openvpn-devel
openvpn-help
openvpn-debugsource
openvpn-debuginfo
openvpn
openvpn (Debian package)

Install security update from vendor's website.

OpenVPN Server - addressed in versions 2.6.21, 2.7.5
openvpn (Ubuntu package) - addressed in versions 2.5.11-0ubuntu0.22.04.4, 2.6.19-0ubuntu0.24.04.3, 2.7.0-1ubuntu1.2
openvpn-devel - update to 2.6.9-8
openvpn-help - update to 2.6.9-8
openvpn-debugsource - update to 2.6.9-8
openvpn-debuginfo - update to 2.6.9-8
openvpn - update to 2.6.9-8
openvpn (Debian package) - update to 2.6.14-1+deb13u3

• https://github.com/OpenVPN/openvpn/releases/tag/v2.6.21
• https://github.com/OpenVPN/openvpn/commit/4dee614e4e799d6d4a20bffabd902291c86406f2

• Multiple vulnerabilities in OpenVPN Server
• Debian update for openvpn
• openEuler 24.03 LTS SP1 update for openvpn
• openEuler 24.03 LTS SP3 update for openvpn
• openEuler 24.03 LTS SP4 update for openvpn
• Ubuntu update for openvpn