# CVE-2026-12996 - Potential DoS and memory leak via TLS session use-after-free
-
TBD
+
A use-after-free vulnerability in OpenVPN 2.x allows a remote authenticated peer to potentially cause a denial of service (server crash) or potentially leak sensitive heap memory. This occurs because certain per-session buffers, specifically ack_write_buf, are not properly guarded during TLS session promotion or when a session expires (TM_LAME_DUCK), leading to a shallow copy being sent after the session memory has been freed. This issue is caused by an incomplete fix for [CVE-2026-40215](../CVE-2026-40215).
+
+
Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.
