CVE-2026-82325: OpenVPN ovpn-dco-win Use-After-Free Flaw

CVE-2026-82325 Overview

CVE-2026-82325 is a use-after-free vulnerability in the OpenVPN ovpn-dco-win kernel driver, affecting versions 2.5.0 through 2.8.6. The flaw resides in the driver's handling of crafted control messages. A local authenticated user can trigger the condition to cause a system crash, resulting in denial of service on the affected Windows host. The Common Weakness Enumeration classifies this issue as [CWE-415] Double Free, tied to improper lifecycle management of kernel memory objects.

Critical Impact
Local authenticated users can crash the Windows host by sending crafted control messages to the OpenVPN Data Channel Offload (DCO) kernel driver, disrupting VPN availability.

Affected Products

OpenVPN ovpn-dco-win driver version 2.5.0
OpenVPN ovpn-dco-win driver versions 2.6.x through 2.8.5
OpenVPN ovpn-dco-win driver version 2.8.6

Discovery Timeline

2026-09-07 - CVE-2026-82325 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82325

Vulnerability Analysis

The ovpn-dco-win driver implements Data Channel Offload for OpenVPN on Windows, moving encrypted tunnel processing into the kernel for performance. The vulnerability exists in the control message handling path exposed to local user-mode clients. When a specially crafted control message is processed, the driver frees a kernel object but continues to reference it, leading to a use-after-free condition.

Because the flaw is triggered inside a kernel driver, dereferencing the stale pointer results in a bugcheck (BSOD) and immediate loss of host availability. Exploitation requires local access and valid authentication, which limits the attack surface to users already present on the system. Refer to the OpenVPN Security Announcement for vendor technical details.

Root Cause

The underlying issue is improper object lifetime management in the driver's IOCTL handling code. A code path frees a structure associated with a control message without invalidating remaining references. Subsequent operations dereference the freed memory, corrupting kernel state.

Attack Vector

The attack vector is local. An authenticated user with the ability to open a handle to the ovpn-dco-win device and issue control IOCTLs can send crafted messages that reach the vulnerable code path. No user interaction beyond the attacker's own actions is required, and the impact is limited to availability of the host system. No verified proof-of-concept code is publicly available. See the OpenVPN Security Announcement for further context.

Detection Methods for CVE-2026-82325

Indicators of Compromise

Unexpected Windows bugcheck (BSOD) events referencing ovpn-dco-win.sys in MEMORY.DMP or minidump files.
Windows Event Log entries with Event ID 1001 (BugCheck) shortly after user-mode processes interact with the OpenVPN device object.
Repeated crashes correlated with non-administrative user sessions on hosts running vulnerable driver versions.

Detection Strategies

Inventory endpoints for the presence and version of ovpn-dco-win.sys and flag hosts running 2.5.0 through 2.8.6.
Monitor kernel crash telemetry and correlate bugcheck stacks that reference the OpenVPN DCO driver with the invoking user context.
Alert on non-service accounts opening handles to the \\.\ovpn-dco device and issuing IOCTLs.

Monitoring Recommendations

Ingest Windows crash and Application/System event logs into a centralized SIEM for correlation with user activity.
Track driver version drift across the fleet to identify unpatched endpoints after remediation is issued.
Baseline expected OpenVPN client behavior and alert on anomalous IOCTL volume or unusual invocation patterns.

How to Mitigate CVE-2026-82325

Immediate Actions Required

Identify all Windows endpoints running ovpn-dco-win versions 2.5.0 through 2.8.6.
Restrict interactive and remote logon rights on hosts running vulnerable driver versions to trusted administrators only.
Prioritize patching of shared or multi-user systems where local authenticated users pose the greatest risk.

Patch Information

Consult the OpenVPN Security Announcement for the fixed driver version and upgrade instructions. Deploy the vendor-provided update to all affected Windows endpoints and validate the driver version after installation.

Workarounds

Uninstall or disable the ovpn-dco-win driver on hosts where Data Channel Offload is not required, and fall back to the legacy tap-windows6 or wintun adapter.
Limit local logon rights on VPN endpoints to reduce the population of users capable of triggering the flaw.
Enforce application allowlisting to prevent untrusted binaries from opening handles to the OpenVPN device object.

bash

# Query installed OpenVPN DCO driver version on Windows
Get-WmiObject Win32_PnPSignedDriver | \
  Where-Object { $_.DeviceName -like '*OpenVPN Data Channel Offload*' } | \
  Select-Object DeviceName, DriverVersion, DriverProviderName