{"id":"CVE-2023-46850","title":"Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.","summary":"Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-416"],"vendor":"openvpn","product":"openvpn","affected":["openvpn >= 2.6.0, <= 2.6.6","openvpn_access_server >= 2.11.0, <= 2.11.3","openvpn_access_server >= 2.12.0, < 2.12.2","debian_linux = 12.0","fedora = 39"],"patched":["openvpn_access_server 2.12.2"],"published":"2023-11-11","updated":"2026-06-23","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-46850","references":[{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2023-46850","label":"security@openvpn.net"},{"url":"https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/","label":"security@openvpn.net"},{"url":"https://community.openvpn.net/openvpn/wiki/CVE-2023-46850","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L3FS46ANNTAVLIQY56ZKGM5CBTRVBUNE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/O54I7D753V6PU6XBU26FEROD2DSHEJQ4/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://openvpn.net/security-advisory/access-server-security-update-cve-2023-46849-cve-2023-46850/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.debian.org/security/2023/dsa-5555","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.01999,"epssPercentile":0.79839,"ingestedAt":"2026-06-29T13:24:33.924Z","slug":"CVE-2023-46850","body":"## Overview\n\nUse after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a remote peer.\n\n## Affected\n\n- `openvpn >= 2.6.0, <= 2.6.6`\n- `openvpn_access_server >= 2.11.0, <= 2.11.3`\n- `openvpn_access_server >= 2.12.0, < 2.12.2`\n- `debian_linux = 12.0`\n- `fedora = 39`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `openvpn_access_server 2.12.2`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}