# CVE-2026-13117 - Heap use-after-free via incomplete guard in check_session_buf_not_used()
-
An incomplete guard in the check_session_buf_not_used() function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in tls_wrap_reneg.work.data when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for [CVE-2026-40215](../CVE-2026-40215).
+
An incomplete guard in the `check_session_buf_not_used()` function in OpenVPN 2.6.x and 2.7.x fails to account for aliases in `tls_wrap_reneg.work.data` when dynamic tls-crypt-v2 is active. This allows a remote authenticated peer to trigger a use-after-free condition during TLS session promotion, potentially resulting in a server crash (denial of service) or the leakage of sensitive heap memory to the network peer. This issue is a bypass of the fix for [CVE-2026-40215](../CVE-2026-40215).
