CVE-2026-12996

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.6.0 through 2.6.20 OpenVPN versions 2.7 alpha1 through 2.7.4

Description A use-after-free issue exists where remote authenticated peers can cause a denial of service or memory leakage by sending crafted packets during TLS session promotion or expiry. This occurs due to a use-after-free condition involving ack write buf. Use-after-free is a memory corruption flaw that happens when an application continues to use a pointer after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.