CVE-2024-1305Integer Overflow or Wraparound in Tap-windows6

Severity
9.8CRITICALNVD
EPSS
8.3%
top 7.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJul 8
Latest updateMar 13

Description

tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

CVEListV5openvpn/tap-windows69.26 or earlier
CVEListV5openvpn/openvpn-gui2.6.9 and earlier

🔴Vulnerability Details

1
GHSA
GHSA-fv4p-hrvc-c34g: tap-windows6 driver version 92024-07-08

📋Vendor Advisories

1
CISA ICS
Siemens SINEMA Remote Connect Client2025-03-13

🕵️Threat Intelligence

1
Microsoft
Chained for attack: OpenVPN vulnerabilities discovered leading to RCE and LPE2024-08-08