Critical OpenVPN Flaws Fix: Heap Over-Read (CVSS 9.1) and HMAC Bypass Allow DoS Attacks

The OpenVPN project has issued a security update in the 2.7 series to address two high-severity flaws, including CVE-2025-12106, which carries a CVSS score of 9.1 and stems from insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1. The second issue, CVE-2025-13086, involves a HMAC verification bypass that can allow TLS sessions to be opened from unauthorised IP addresses, potentially enabling resource exhaustion on the server.

The advisory notes that the HMAC flaw affects OpenVPN versions 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1, while the heap over-read affects the same 2.7 branch. Remediation is provided in version 2.7_rc2 for 2.7.x users and in 2.6.16 for 2.6.x users, alongside broader fixes such as improved Windows subsystem hardening and DNS address list generation.

Administrators are urged to upgrade immediately, and the changelog warns that Windows 7 compatibility will be broken as part of these security improvements, published on 2 December 2025 according to the security advisory.