A buffer overflow exists in the Windows DCO client of OpenVPN when processing encrypted packets that place the AEAD tag at the end. Local attackers can send oversized packets to trigger the overflow, resulting in a system crash. The flaw is classified as CWE‑131 and leads solely to denial of service by terminating the client application. No remote code execution or confidentiality compromise is possible.

The vulnerability affects the OpenVPN DCO Windows client, specifically version 2.8.0. The issue is present on Windows operating systems that run this client and may impact any users who are both sending and receiving encrypted traffic through the affected version.

The CVSS score of 5.6 indicates moderate risk, but the EPSS score is reported as less than 1 %, meaning exploitation probability is very low in the current ecosystem. The vulnerability has not been listed in the DOD KEV catalog. Attackers need local access or the ability to send packets to the target client, and the attack does not allow escalation or data exfiltration. The primary concern is a crash of the client application, which could disrupt operations but offers no further privilege gain.