CVE-2025-12106 Memory corruption in OpenVPN

Critical 9.1 Published 1 Dec 2025 Updated 1 Dec 2025

An attacker can trigger a heap buffer over-read in OpenVPN by sending malformed IP addresses, potentially causing a crash or leaking memory.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-12106?

CVE-2025-12106 is a critical memory corruption vulnerability in OpenVPN, published on 1 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses

Weakness: CWE-126

Which versions are affected by CVE-2025-12106?

It affects 1 product.

Products include Openvpn Openvpn.

How do I fix CVE-2025-12106?

No fix has been published for CVE-2025-12106 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2025-12106 being exploited?

There is no known exploitation of CVE-2025-12106 in the wild and no public exploit code.

Sources

Also known as GHSA-xg3m-85r2-236x.