CVE-2024-1305

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://community.openvpn.net/openvpn/wiki/CVE-2024-1305	Vendor Advisory
https://www.mail-archive.com/[email protected]/msg07534.html	Release Notes Mailing List
https://community.openvpn.net/openvpn/wiki/CVE-2024-1305	Vendor Advisory
https://www.mail-archive.com/[email protected]/msg07534.html	Release Notes Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:openvpn:tap-windows6:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-07-08 18:15

Updated : 2025-08-22 15:36

NVD link : CVE-2024-1305

Mitre link : CVE-2024-1305

CVE.ORG link : CVE-2024-1305

JSON object : View

Products Affected

openvpn

tap-windows6

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2024-1305", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-07-08T18:15:07.150", "references": [{"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-1305", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.mail-archive.com/[email protected]/msg07534.html", "tags": ["Release Notes", "Mailing List"], "source": "[email protected]"}, {"url": "https://community.openvpn.net/openvpn/wiki/CVE-2024-1305", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.mail-archive.com/[email protected]/msg07534.html", "tags": ["Release Notes", "Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "tap-windows6 driver version 9.26 and earlier does not properly \ncheck the size data of incomming write operations which an attacker can \nuse to overflow memory buffers, resulting in a bug check and potentially\n arbitrary code execution in kernel space"}, {"lang": "es", "value": "La versi\u00f3n 9.26 y anteriores del controlador tap-windows6 no verifica correctamente los datos de tama\u00f1o de las operaciones de escritura entrantes que un atacante puede usar para desbordar los b\u00fafers de memoria, lo que resulta en una verificaci\u00f3n de errores y la ejecuci\u00f3n de c\u00f3digo potencialmente arbitrario en el espacio del kernel."}], "lastModified": "2025-08-22T15:36:38.907", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openvpn:tap-windows6:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1361B991-0259-40EC-89A2-06B591C84F5C", "versionEndIncluding": "9.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}