CVE-2026-11604 vs OpenVPN 2.7.x Documentation

Hi, the general feedback on this CVE in relation to OpenVPN 2.7.4 and up is not documented. The Wiki at https://community.openvpn.net/Security%20Announcements/CVE-2026-11604 is just TBD Most CVE lists have OpenVPN and OpenVPN-DCO-Win mixed up.

The only real information I found is on the Release History page: https://community.openvpn.net/ReleaseHistory Which says:

Note: Windows MSI was updated to I002 on June 10th. Changes in I002:

Included dco-win driver updated to 2.8.3 CVE-2026-11604: An incorrect buffer size calculation in the epoch key generator in OpenVPN ovpn-dco-win allows a remote authenticated peer to trigger a heap-based buffer overflow and kernel memory corruption via a crafted data packet, resulting in a system crash (denial of service)

And list a table of installers: Windows 64-bit MSI installer - OpenVPN-2.7.4-I002-amd64.msi Windows ARM64 MSI installer - OpenVPN-2.7.4-I002-arm64.msi Windows 32-bit MSI installer - OpenVPN-2.7.4-I002-x86.msi and the source file openvpn-2.7.4.tar.gz

I would like to ask the documentation maintainer to add the missing CVE-2026-11604 info.

see https://nvd.nist.gov/vuln/detail/cve-2026-11604

cpe:2.3:a:openvpn:ovpn-dco-win:*:*:*:*:*:*:*:*
matching CPE(s) 
cpe:2.3:a:openvpn:ovpn-dco-win:2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.0:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.1:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.3:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.4:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.5:*:*:*:*:*:*:*
cpe:2.3:a:openvpn:ovpn-dco-win:2.5.6:*:*:*:*:*:*:*
From (including) 2.0.0 Up to (including) 2.8.3

I wrote to NVD about the mismatch and they asked for the official documentation. I've sent them the Release History URL, but I am not sure if it's enough.

Thanks