CVE-2024-1305

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security@openvpn.net

Published

2024-07-08

Last modified

2024-08-23

Weaknesses

CWE-190

Affected products

• Openvpn-gui (Openvpn)
• Openvpn Gui (Openvpn)
• Tap-windows6 (Openvpn)
• Tap Windows6 (Openvpn)

References

• https://community.openvpn.net/openvpn/wiki/CVE-2024-1305
• https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html