CVE-2026-105390
Quick assessment
Affected
OpenVPN ovpn-dco-win
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenVPN ovpn-dco-win 在 Windows 系统上的 0.6.5 至 1.3.5 版本以及 2.4.0 至 2.8.7 版本中存在不正确的同步机制。本地攻击者可通过构造对 ovpn-dco 设备的写入操作触发死锁，导致主机无响应。
Possible ATT&CK Techniques 1 AI
T1499.001 · OS Exhaustion Flood
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105390
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
资源加锁不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenVPN | ovpn-dco-win | 0.6.5 ~ 1.3.5 | - |
|
II. Public POCs for CVE-2026-105390
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105390
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105390 (1)
-
🔗 CVE-2026-105390 – community wiki vendor-advisory
Same Patch Batch · OpenVPN · 2026-10-13 · 3 CVEs total
| CVE-2026-84790 | 7.6 HIGH | OpenVPN 2.3.0-2.6.22及2.7版身份伪造漏洞 |
| CVE-2026-88964 | 7.1 HIGH | OpenVPN 2.7.7整数下溢致DoS/信息泄露 |
IV. Related Vulnerabilities
Same weakness: CWE-413
-
CVE-2026-92615
Flightctl: flightctl: package-global go-git https transport -
CVE-2026-44608
Use after free and crash under special conditions in RPZ cod -
CVE-2026-32748
Squid has Denial of Service in ICP Response handling -
CVE-2025-0003
AMD Xilinx Run Time 安全漏洞 -
CVE-2025-3450
Automation Runtime SDM requests may impact system
V. Comments for CVE-2026-105390
No comments yet