Improper synchronization in the OpenVPN ovpn-dco-win driver for Windows allows a local attacker to craft a write to the ovpn-dco device, causing the driver to enter a deadlock and rendering the host unresponsive. The result is a denial of service that does not provide a direct path to code execution or privilege escalation. The weakness is a synchronization race that can be triggered from within user‑mode, resulting in a system lockup.

OpenVPN’s Windows client, known as ovpn-dco-win, is affected. The vulnerability applies to Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7.

The CVSS score of 6.9 indicates a medium severity denial of service, while the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that the attack vector is local, requiring a user with write access to the ovpn-dco device to trigger the deadlock.