CVE-2024-1305 is a critical vulnerability affecting the tap-windows6 driver version 9.26 and earlier, commonly used by OpenVPN. This flaw stems from insufficient size checks on incoming write operations, allowing an attacker to trigger a memory buffer overflow. The vulnerability carries a CVSS score of 9.8 (CRITICAL) due to its network-based attack vector, low attack complexity, and potential for a bug check, leading to denial of service or arbitrary code execution in kernel space. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 11 mentions, indicating high awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 9.26.0CPE matchmatch criteria | cpe:2.3:a:openvpn:tap-windows6:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.