CVE-2025-13751

moderate-risk
Published 2025-12-03

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (9)

Affected Vendors

Openvpn

References (3)

Vendor Advisory https://community.openvpn.net/Security%20Announcements/CVE-2025-13751
Mailing List https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00153.htm...
Mailing List https://www.mail-archive.com/openvpn-announce@lists.sourceforge.net/msg00154.htm...
33
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 15/34 · Moderate