CVE-2024-1305

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.openvpn.net/openvpn/wiki/CVE-2024-1305	Vendor Advisory
https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html	Release Notes Mailing List
https://community.openvpn.net/openvpn/wiki/CVE-2024-1305	Vendor Advisory
https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html	Release Notes Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:openvpn:tap-windows6:*:*:*:*:*:*:*:*

History

22 Aug 2025, 15:36

Type	Values Removed	Values Added
CPE		cpe:2.3:a:openvpn:tap-windows6::::::::
First Time		Openvpn Openvpn tap-windows6
References	~~() https://community.openvpn.net/openvpn/wiki/CVE-2024-1305 -~~	() https://community.openvpn.net/openvpn/wiki/CVE-2024-1305 - Vendor Advisory
References	~~() https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html -~~	() https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html - Release Notes, Mailing List

Information

Published : 2024-07-08 18:15

Updated : 2025-08-22 15:36

NVD link : CVE-2024-1305

Mitre link : CVE-2024-1305

CVE.ORG link : CVE-2024-1305

JSON object : View

Products Affected

openvpn

tap-windows6

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-1305", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-07-08T18:15:07.150", "references": [{"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-1305", "tags": ["Vendor Advisory"], "source": "security@openvpn.net"}, {"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html", "tags": ["Release Notes", "Mailing List"], "source": "security@openvpn.net"}, {"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-1305", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mail-archive.com/openvpn-users@lists.sourceforge.net/msg07534.html", "tags": ["Release Notes", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@openvpn.net", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "tap-windows6 driver version 9.26 and earlier does not properly \ncheck the size data of incomming write operations which an attacker can \nuse to overflow memory buffers, resulting in a bug check and potentially\n arbitrary code execution in kernel space"}, {"lang": "es", "value": "La versi\u00f3n 9.26 y anteriores del controlador tap-windows6 no verifica correctamente los datos de tama\u00f1o de las operaciones de escritura entrantes que un atacante puede usar para desbordar los b\u00fafers de memoria, lo que resulta en una verificaci\u00f3n de errores y la ejecuci\u00f3n de c\u00f3digo potencialmente arbitrario en el espacio del kernel."}], "lastModified": "2025-08-22T15:36:38.907", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openvpn:tap-windows6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1361B991-0259-40EC-89A2-06B591C84F5C", "versionEndIncluding": "9.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@openvpn.net"}