Blame
| 957eeb | uddr | 2025-11-28 20:04:05 | 1 | # CVE-2025-13751 - Windows/interactive service: fix erroneous exit on error that could be used by a local Windows users to achieve a local denial-of-service |
| 2 | ||||
| 3 | Windows/interactive service: fix bug where the interactive service would error-exit in certain error conditions instead of just logging the fact and continuing. |
|||
| 4 | After the error-exit, OpenVPN connections will no longer work until the service is restarted (or the system rebooted). |
|||
| 5 | This can be triggered by any authenticated local user, and has thus been classified as a "local denial of service" attack. |
|||
| 6 | ||||
| 7 | OpenVPN version 2.6.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 are affected. This is fixed in version 2.6.17 and 2.7_rc3. |
|||
| 8 | ||||
| 9 | CVE Record: [CVE-2025-13751](https://www.cve.org/CVERecord?id=CVE-2025-13751) |
|||
| 10 | ||||
| 11 | Github: [OpenVPN/openvpn-private-issues#95](https://github.com/OpenVPN/openvpn-private-issues/issues/95) |
|||
| 12 | ||||
| 13 | Release notes: [openvpn-2.7_rc3](https://community.openvpn.net/ReleaseHistory#openvpn-27_rc3-released-28-november-2025) [openvpn-2.6.17](https://community.openvpn.net/ReleaseHistory#openvpn-2617-released-28-november-2025) |
|||
| 14 | ||||
| 15 | Reported by: Lev Stipakov <lev@openvpn.net> |