How severe is CVE-2026-2738?

CVE-2026-2738 has a CVSS 4.0 base score of 5.6, rated medium severity.

Is CVE-2026-2738 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-2738?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-2738 have an EU (EUVD) identifier?

Yes. CVE-2026-2738 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8311.

When was CVE-2026-2738 published?

CVE-2026-2738 was published on 2026-02-19 and last updated on 2026-06-17.

CVE-2026-2738

CVE-2026-2738 is a medium-severity vulnerability with a CVSS 4.0 base score of 5.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-131.

Key facts

Severity: Medium (CVSS 4.0 base score 5.6)
EPSS exploit prediction: 0% (2nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-8311
Weakness: CWE-131
Published: 2026-02-19
Last modified: 2026-06-17

Description

Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet

Frequently asked questions

What is CVE-2026-2738?: Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packets to the remote peer when the AEAD tag appears at the end of the encrypted packet
How severe is CVE-2026-2738?: CVE-2026-2738 has a CVSS 4.0 base score of 5.6, rated medium severity.
Is CVE-2026-2738 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (2nd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-2738?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-2738 have an EU (EUVD) identifier?: Yes. CVE-2026-2738 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8311.
When was CVE-2026-2738 published?: CVE-2026-2738 was published on 2026-02-19 and last updated on 2026-06-17.

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-2738

Other CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities

CVE-2026-52955 — Critical (CVSS 9.8): In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in…
CVE-2026-41676 — Critical (CVSS 9.8): rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.27 to before 0.10.78,…
CVE-2026-1949 — Critical (CVSS 9.8): Delta Electronics AS320T has incorrect calculation of the buffer size on the stack in the GET/PUT request handler of…
CVE-2026-20911 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the HuffTable::initval functionality of LibRaw Commit 0b56545 and…
CVE-2025-1861 — Critical (CVSS 9.8): In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when…
CVE-2023-5941 — Critical (CVSS 9.8): In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the…

Browse all CWE-131 (Incorrect Calculation of Buffer Size) vulnerabilities →