CVE-2026-105390
Medium · CVSS 6.9Published 2026-10-13
CVSS
6.9
Medium
EPSS
—
exploit probability
Active Exploit
No
not yet listed
Medium — next window — Medium severity. Include in your next scheduled maintenance window.
What is CVE-2026-105390?
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers to trigger a deadlock via a crafted write to the ovpn-dco device, causing the host to become unresponsive.
Likely affects:Windows
CVSS Score Explained
CVSS 6.9 is Medium severity. Exploitation usually requires some specific conditions (local access, user interaction, or a particular config). Still worth patching in your next maintenance window.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-88964An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options7.1
- CVE-2026-53564Vulnerability in Citrix UniconOS leading to Arbitrary file read and write
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.5.1
- CVE-2026-15468Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.
This issue affects HYPR Passwordless: before 11.3.3.6.9
- CVE-2026-53563Vulnerability in Citrix UniconOS leading to Persistent Command Execution
This issue affects UniconOS: before 2607.2 CR and before 2603 LTSR CU2.6.9
- CVE-2026-105142Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—
- CVE-2026-105151Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.—