CVE-2024-27459 Memory corruption in OpenVPN GUI
An attacker can trigger a stack overflow in the OpenVPN GUI interactive service to execute arbitrary code with elevated privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27459?
CVE-2024-27459 is a high-severity memory corruption vulnerability in OpenVPN GUI, published on 8 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The interactive service in OpenVPN 2.6.9 and earlier allows an attacker to send data causing a stack overflow which can be used to execute arbitrary code with more privileges.
Which versions are affected by CVE-2024-27459?
It affects 1 product.
Products include Openvpn Openvpn.
How do I fix CVE-2024-27459?
No fix has been published for CVE-2024-27459 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-27459 being exploited?
There is no known exploitation of CVE-2024-27459 in the wild and no public exploit code.
Other vulnerabilities in OpenVPN GUI
Sources
Also known as GHSA-f6v5-hjxr-p24j.