CVE-2026-105390
Awaiting Analysis Awaiting Analysis - Queue

Improper Synchronization Deadlock in OpenVPN ovpn-dco-win

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: OpenVPN Inc.

Description
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-14
Generated
2026-10-19
AI Q&A
2026-10-14
EPSS Evaluated
2026-10-18
NVD
CVE-2026-105390
EUVD
EUVD-2026-100757

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
OpenVPN ovpn-dco-win 0.6.5
OpenVPN ovpn-dco-win 2.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-413 The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
CWE-833 The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper synchronization in OpenVPN's ovpn-dco-win for Windows. It affects versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7. A local attacker can exploit this by sending a crafted write to the ovpn-dco device, triggering a deadlock that makes the host unresponsive.

Impact Analysis

If exploited, this vulnerability could cause your Windows system running OpenVPN to freeze or become unresponsive. This may lead to denial of service, disrupting network connectivity and access to services relying on OpenVPN.

Mitigation Strategies

Update OpenVPN ovpn-dco-win to a version outside the vulnerable range (0.6.5 through 1.3.5 and 2.4.0 through 2.8.7). Disable or restrict access to the ovpn-dco device for untrusted users to prevent crafted writes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart