CVE-2024-5198

OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.

Score

CVSS 3.1 3.3 Low

Status

Analyzed - security@openvpn.net

Published

2025-01-15

Last modified

2025-01-15

Weaknesses

CWE-476

Affected products

• Openvpn-gui (Openvpn)
• Ovpn-dco (Openvpn)
• Ovpn-dco-win (Openvpn)

References

• https://community.openvpn.net/openvpn/wiki/CVE-2024-5198