CVE-2026-12996 - Potential DoS and memory leak via TLS session use-after-free
A use-after-free vulnerability in OpenVPN 2.x allows a remote authenticated peer to potentially cause a denial of service (server crash) or potentially leak sensitive heap memory. This occurs because certain per-session buffers, specifically ack_write_buf, are not properly guarded during TLS session promotion or when a session expires (TM_LAME_DUCK), leading to a shallow copy being sent after the session memory has been freed. This issue is caused by an incomplete fix for CVE-2026-40215.
Affects versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. This is fixed in versions 2.6.21 and 2.7.5.
CVE Record: CVE-2026-12996
Github:
Release notes:
Reported-By: Hcamael
Reported-By: 章鱼哥 (@aipy) (www.aipyaipy.com)