CVE catalog

CVE-2024-4877

openvpn: CVE-2024-4877

[CVE catalog]

Severity
Medium · CVSS 4.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianopenvpnsid2.7.8-1not affected
Debianopenvpnforky2.7.8-1not affected
Debianopenvpntrixie2.6.14-1+deb13u3not affected
Debianopenvpntrixie-security2.6.14-1+deb13u3not affected
Debianopenvpnbookworm2.6.14-0+deb12u2not affected
Debianopenvpnbookworm-security2.6.14-0+deb12u2not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianopenvpnsourcesidNot affectedunimportantNot reportedNot reported
DebianopenvpnsourceforkyNot affectedunimportantNot reportedNot reported
DebianopenvpnsourcetrixieNot affectedunimportantNot reportedNot reported
DebianopenvpnsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [openvpn]Unknown
    Details (4)

    • 2.6.14-0+deb12u2 · amd64 · bookworm

      Not affected

      dsa · openvpn · debian · bookworm

    • 2.6.14-0+deb12u2 · arm64 · bookworm

      Not affected

      dsa · openvpn · debian · bookworm

    • 2.6.14-0+deb12u2 · amd64 · bookworm-security

      Not affected

      dsa · openvpn · debian · bookworm

    • 2.6.14-0+deb12u2 · arm64 · bookworm-security

      Not affected

      dsa · openvpn · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]