OpenVPN

A critical buffer overflow vulnerability in OpenVPN’s data channel offload driver for Windows allowed local attackers to crash systems by sending maliciously crafted control messages. The vulnerability, identified as CVE-2025-50054, affects versions 1.3.0 and earlier, as well as version 2.5.8 and earlier. This denial-of-service risk could repeatedly crash Windows machines running vulnerable OpenVPN installations, impacting system availability without compromising data confidentiality or integrity. OpenVPN 2.7_alpha2 fixes the issue and improves Windows support, but users should update promptly and restrict driver access until stable patches are available.

Source: https://cybersecuritynews.com/openvpn-driver-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/openvpn

"id": "ope900062125",
"linkid": "openvpn",
"type": "Vulnerability",
"date": "6/2025",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'industry': 'Networking',
                        'name': 'OpenVPN',
                        'type': 'Software'}],
 'attack_vector': 'Local',
 'description': 'A critical buffer overflow vulnerability in OpenVPN’s data '
                'channel offload driver for Windows, identified as '
                'CVE-2025-50054, allows local attackers to crash Windows '
                'systems by sending maliciously crafted control messages. The '
                'vulnerability affects ovpn-dco-win driver versions 1.3.0 and '
                'earlier, as well as version 2.5.8 and earlier, which has been '
                'the default virtual network adapter in OpenVPN since version '
                '2.6. The OpenVPN community project team has released OpenVPN '
                '2.7_alpha2, which includes a fix for the vulnerability.',
 'motivation': 'Denial of Service',
 'recommendations': ['Update to OpenVPN 2.7_alpha2',
                     'Restrict local access to the OpenVPN driver interfaces'],
 'response': {'remediation_measures': ['Update to OpenVPN 2.7_alpha2',
                                       'Restrict local access to the OpenVPN '
                                       'driver interfaces']},
 'title': 'Critical OpenVPN Windows Driver Flaw (CVE-2025-50054)',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2025-50054'}

OpenVPN

Apache

Kong

Cisco