# CVE-2025-13751 - Windows/interactive service: fix erroneous exit on error that could be used by a local Windows users to achieve a local denial-of-service

Windows/interactive service: fix bug where the interactive service would error-exit in certain error conditions instead of just logging the fact and continuing.
After the error-exit, OpenVPN connections will no longer work until the service is restarted (or the system rebooted).
This can be triggered by any authenticated local user, and has thus been classified as a "local denial of service" attack.

OpenVPN version 2.6.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 are affected. This is fixed in version 2.6.17 and 2.7_rc3.

CVE Record: [CVE-2025-13751](https://www.cve.org/CVERecord?id=CVE-2025-13751)

Github: [OpenVPN/openvpn-private-issues#95](https://github.com/OpenVPN/openvpn-private-issues/issues/95)

Release notes: [openvpn-2.7_rc3](https://community.openvpn.net/ReleaseHistory#openvpn-27_rc3-released-28-november-2025) [openvpn-2.6.17](https://community.openvpn.net/ReleaseHistory#openvpn-2617-released-28-november-2025)

Reported by: Lev Stipakov <lev@openvpn.net>