CVE-2026-105390
Received
Received - Intake
Improper Synchronization Deadlock in OpenVPN ovpn-dco-win
Vulnerability report for CVE-2026-105390, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: OpenVPN Inc.
Description
Description
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| OpenVPN | ovpn-dco-win | 0.6.5 |
| OpenVPN | ovpn-dco-win | 2.4.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-413 | The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource. |
| CWE-833 | The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. |
