CVE-2026-11604 Overview
CVE-2026-11604 is a heap-based buffer overflow [CWE-122] in the OpenVPN ovpn-dco-win kernel driver. The flaw resides in the epoch key generator and stems from an incorrect buffer size calculation. Affected versions span 2.0.0 through 2.8.3 of the Data Channel Offload driver for Windows. A remote authenticated peer can send a crafted data packet that triggers kernel memory corruption. Successful exploitation crashes the system, producing a denial-of-service condition on the Windows host running the OpenVPN client or server.
Critical Impact
An authenticated VPN peer can corrupt Windows kernel memory through a crafted data packet, forcing a system crash and disrupting VPN-dependent services.
Affected Products
- OpenVPN ovpn-dco-win version 2.0.0
- OpenVPN ovpn-dco-win versions 2.1.0 through 2.8.2
- OpenVPN ovpn-dco-win version 2.8.3
Discovery Timeline
- 2026-06-10 - CVE-2026-11604 published to the National Vulnerability Database (NVD)
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-11604
Vulnerability Analysis
The ovpn-dco-win driver implements Data Channel Offload for OpenVPN on Windows, moving encryption and packet processing into kernel space for performance. The driver supports an epoch key mechanism, which rotates session keys without renegotiating the control channel. The epoch key generator miscomputes the size of an internal buffer used during key derivation. When a peer transmits a data packet that exercises this code path, the driver writes beyond the allocated heap region in non-paged kernel pool memory.
Kernel-mode heap corruption in a Windows driver typically results in a bug check (BSOD), terminating all processes and dropping every VPN session terminating on the affected host. Because the corruption occurs in kernel space, the impact extends beyond the OpenVPN process to the entire operating system.
Root Cause
The root cause is an incorrect buffer size calculation [CWE-122] inside the epoch key generator routine. The driver allocates a buffer based on an undersized length value, then writes a larger quantity of key material into that allocation. This produces an out-of-bounds write in the kernel heap.
Attack Vector
Exploitation requires an authenticated OpenVPN peer relationship with the target. The attacker must complete the OpenVPN handshake, then send a crafted data packet that reaches the vulnerable epoch key derivation path. The attack vector is local in CVSS terms because the malicious input traverses an established VPN tunnel rather than an unauthenticated network surface. The observed impact is loss of availability through kernel crash; confidentiality and integrity are not directly affected. Refer to the OpenVPN Security Announcement CVE-2026-11604 for vendor-provided technical context.
Detection Methods for CVE-2026-11604
Indicators of Compromise
- Unexpected Windows bug check events referencing ovpn-dco.sys or related OpenVPN kernel modules in Minidump files.
- Repeated System event log entries showing the OpenVPN service restarting after kernel faults.
- Abrupt termination of all VPN tunnels on a host running ovpn-dco-win between 2.0.0 and 2.8.3.
Detection Strategies
- Inventory Windows endpoints and servers running OpenVPN with the ovpn-dco-win driver and verify the installed driver version against 2.8.4 or later.
- Correlate kernel crash dumps with ovpn-dco stack frames to identify hosts that may have been targeted.
- Monitor authenticated VPN peers for anomalous data packet patterns immediately preceding host crashes.
Monitoring Recommendations
- Forward Windows System and Application event logs, along with WER crash telemetry, to a central log platform for correlation.
- Alert on BugCheck events (Event ID 1001) whose faulting module is the OpenVPN DCO driver.
- Track VPN session terminations correlated with host reboots across the fleet to identify clusters of impacted systems.
How to Mitigate CVE-2026-11604
Immediate Actions Required
- Upgrade ovpn-dco-win to the fixed release published on the GitHub OpenVPN DCO Win Release page.
- Restrict VPN peer authentication to trusted certificates and revoke credentials for any peer suspected of abuse.
- Audit OpenVPN server configurations to confirm that only known clients can establish authenticated sessions.
Patch Information
OpenVPN has released a fixed version of ovpn-dco-win that corrects the buffer size calculation in the epoch key generator. Administrators should obtain the updated driver from the official GitHub OpenVPN DCO Win Release page and consult the OpenVPN Security Announcement CVE-2026-11604 for version-specific guidance.
Workarounds
- Disable the Data Channel Offload feature and revert clients to the userspace OpenVPN data path until the driver is updated.
- Tighten certificate issuance and shorten certificate lifetimes to reduce the population of peers that could send malicious packets.
- Segment OpenVPN concentrators so that a kernel crash on one host does not interrupt service for the entire user base.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
