CVE-2024-5198 Null dereference in OpenVPN-GUI

Low 3.3 Published 15 Jan 2025 Updated 15 Jan 2025

An unprivileged local attacker can cause a system halt in OpenVPN for Windows by sending invalid I/O control messages to the driver.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-5198?

CVE-2024-5198 is a low-severity vulnerability in OpenVPN-GUI, published on 15 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt.

Weakness: CWE-476

Which versions are affected by CVE-2024-5198?

It affects 1 product.

Products include Openvpn Ovpn-Dco-Win.

How do I fix CVE-2024-5198?

No fix has been published for CVE-2024-5198 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-5198 being exploited?

There is no known exploitation of CVE-2024-5198 in the wild and no public exploit code.

Sources

Also known as GHSA-cp7w-whjm-pp36.