TI-2025-11102 Aliases CVE-2025-12106 GHSA-xg3m-85r2-236x

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker…

MEDIUM 46CWE-126Published 2025-12-01 · Updated 2025-12-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00577 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenVPN	OpenVPN	2.7_alpha1 – 2.7_rc1	—	No fix listed	CNA

OpenVPN VendorOpenVPN Affected 2.7_alpha1 – 2.7_rc1 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:openvpn:openvpn:2.6.13::::community:::	2.6.13	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha1:::community:::*	2.7 alpha1	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha2:::community:::*	2.7 alpha2	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha3:::community:::*	2.7 alpha3	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta1:::community:::*	2.7 beta1	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta2:::community:::*	2.7 beta2	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta3:::community:::*	2.7 beta3	Vulnerable	OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:rc1:::community:::*	2.7 rc1	Vulnerable	OpenVPN

cpe:2.3:a:openvpn:openvpn:2.6.13:*:*:*:community:*:*:* Versions 2.6.13 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha1:*:*:community:*:*:* Versions 2.7 alpha1 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha2:*:*:community:*:*:* Versions 2.7 alpha2 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:alpha3:*:*:community:*:*:* Versions 2.7 alpha3 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta1:*:*:community:*:*:* Versions 2.7 beta1 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta2:*:*:community:*:*:* Versions 2.7 beta2 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:beta3:*:*:community:*:*:* Versions 2.7 beta3 Vulnerable ·OpenVPN
cpe:2.3:a:openvpn:openvpn:2.7:rc1:*:*:community:*:*:* Versions 2.7 rc1 Vulnerable ·OpenVPN

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2025-12106
2026-10-03 Alias added: GHSA-xg3m-85r2-236x

References

Advisory 1

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106

Other 1

https://www.mail-archive.com/[email protected]/msg00152.html

TI-2014-04453 Unquoted Windows search path vulnerability in the ptservice service prior to… CVSS 3.1MEDIUM 5.3
TI-2022-00467 Authentication bypass in OpenVPN CVSS 3.1CRITICAL 9.8
TI-2024-18509 Unrestricted file upload in OpenVPN 2 CVSS 3.1CRITICAL 9.8
TI-2024-16468 The interactive service in OpenVPN 2.6.9 and earlier allows the OpenVPN service pipe to… CVSS 3.1HIGH 7.5
TI-2023-25309 Use after free in OpenVPN 2 CVSS 3.1CRITICAL 9.8
TI-2024-05196 OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker… CVSS 3.1CRITICAL 9.1

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences