CVE-2026-82325: 
OpenVPN vulnerability analysis and mitigation

CVE-2026-82325 is a use-after-free (and double-free) vulnerability in the OpenVPN ovpn-dco-win Windows kernel driver that allows local authenticated users to cause a system crash via crafted control messages. It affects driver versions 2.5.0 through 2.8.6, with versions prior to 2.5.0 and after 2.8.6 listed as unaffected. The vulnerability was published on September 7, 2026, and carries a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, ENISA EUVD).

The root cause is classified as CWE-416 (Use After Free) and CWE-415 (Double Free), meaning the driver incorrectly manages memory references for kernel objects after they have been freed, potentially allowing a second free operation on the same memory address. An attacker with local authenticated access can send specially crafted control messages to the ovpn-dco-win driver, triggering the improper memory handling and causing a kernel crash (Blue Screen of Death / BSOD). The attack requires low privileges, no user interaction, and no special attack conditions beyond local access (GitHub Advisory, ENISA EUVD).

Successful exploitation results in a system crash (denial of service), causing unexpected reboots and disruption of all services running on the affected Windows host. There is no assessed impact to confidentiality or integrity — the vulnerability is limited to availability of the vulnerable system. Subsequent systems are not impacted, and no lateral movement or data exfiltration capability has been identified (GitHub Advisory, ENISA EUVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of publication. The EPSS score is approximately 0.099% (1st percentile), indicating a low probability of exploitation in the near term. The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as non-automatable. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, ENISA EUVD).

Update the OpenVPN ovpn-dco-win driver to a version newer than 2.8.6, which contains the fix for this vulnerability. As a compensating control, restrict local system access to trusted and authorized users only to reduce the attack surface. Monitor for unexplained system crashes or BSODs referencing the OpenVPN driver and investigate any unexpected reboots on systems running the affected driver versions (GitHub Advisory, OpenVPN Advisory).