CVE-2025-12106

critical · 9.1

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

9.1

CVSS

0.6%

EPSS (exploit prob.)

45th

EPSS percentile

2025-12-01

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weaknesses

CWE-126

Affected products

Vendor	Product	Affected versions
openvpn	openvpn	2.6.13
openvpn	openvpn	2.7
openvpn	openvpn	2.7
openvpn	openvpn	2.7
openvpn	openvpn	2.7
openvpn	openvpn	2.7
openvpn	openvpn	2.7
openvpn	openvpn	2.7

Check a specific version with /api/v1/cve/match.

References

https://community.openvpn.net/Security%20Announcements/CVE-2025-12106
https://www.mail-archive.com/[email protected]/msg00152.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-12106