CVE-2026-81738
Received Received - Intake

Out-of-Bounds Write in OpenVPN Windows tap-windows6 Driver

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: OpenVPN Inc.

Description
OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-81738
EUVD
EUVD-2026-72278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openvpn openvpn From 2.5.0 (inc) to 2.7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds write issue in OpenVPN versions 2.5.0 through 2.7.6 on Windows. It is caused by crafted DOMAIN-SEARCH entries that trigger memory corruption in the tap-windows6 driver.

Detection Guidance

This vulnerability affects OpenVPN 2.5.0 through 2.7.6 on Windows with the tap-windows6 driver. Detection requires checking the installed OpenVPN version and tap-windows6 driver version. Use 'openvpn --version' to check OpenVPN version and 'driverquery' in Command Prompt to verify tap-windows6 driver details.

Impact Analysis

An attacker could exploit this to cause crashes, execute arbitrary code, or gain elevated privileges on affected systems. It may lead to unauthorized access or data leakage depending on the system configuration.

Compliance Impact

The vulnerability involves an out-of-bounds write in OpenVPN's tap-windows6 driver on Windows, which could allow attackers to execute arbitrary code or cause denial-of-service conditions. This could potentially lead to unauthorized access to sensitive data transmitted over VPN connections, impacting compliance with standards like GDPR (data protection) and HIPAA (healthcare data privacy) by increasing the risk of data breaches or unauthorized disclosures.

Mitigation Strategies

Upgrade OpenVPN to a version beyond 2.7.6 and ensure the tap-windows6 driver is updated to a patched version to prevent out-of-bounds writes from crafted DOMAIN-SEARCH entries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81738. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart