9.1

CVE-2025-12106

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openvpn ≫ Openvpn Version 2.6.13 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update alpha1 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update alpha2 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update alpha3 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update beta1 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update beta2 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update beta3 SwEdition community
Openvpn ≫ Openvpn Version 2.7 Update rc1 SwEdition community
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.425
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-126 Buffer Over-read

The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00152.html
Mailing List
https://community.openvpn.net/Security%20Announcements/CVE-2025-12106
Vendor Advisory