# CVE-2024-5198: OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt. Affected versions: ovpn-dco Windows driver 1.1.1, OpenVPN 2.6.10-I002 Windows client (older and newer versions of the driver and Windows client are not affected) ### References * GitHub PR: https://github.com/OpenVPN/ovpn-dco-win/pull/70 * CVE record: https://www.cve.org/CVERecord?id=CVE-2024-5198 * Reported-By: Lukas Jokubauskas <lukas.jokubauskas@nordsec.com>
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9