CVE-2025-13751

Interactive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local...

1.3 Low

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.18%Up 0.2 points since Dec 4, 2025

What each source reports

CVE List Score used 1.3

Record: CVE-2025-13751
CVSS 4.0: 1.3 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear
Weakness: CWE-770, CWE-775, CWE-841
Updated: 2026-11-02

EUVDEUVD-2025-200999 1.3

Record: EUVD-2025-200999
CVSS 4.0: 1.3 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear
Updated: 2026-11-02

GitHub AdvisoriesGHSA-74jr-8vhj-2c3f 1.3

Interactive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local...

Interactive service agent in OpenVPN version 2.5.0 through 2.7_rc2 on Windows allows a local authenticated user to connect to the service and trigger an error causing a local denial of service.

Record: GHSA-74jr-8vhj-2c3f
CVSS 4.0: 1.3 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

NVD 1.3

Record: CVE-2025-13751
CVSS 4.0: 1.3 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770, CWE-775, CWE-841
Updated: 2026-11-02

OSVALPINE-CVE-2025-13751 5.5

Record: ALPINE-CVE-2025-13751
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV 1.3

Record: CVE-2025-13751
CVSS 4.0: 1.3 LowCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/U:Clear
Weakness: CWE-770, CWE-775, CWE-841
Updated: 2026-11-02

Affected products

openvpn

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13751 is a low vulnerability (CVSS 1.3) in Openvpn, published December 3, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 7th percentile. No source names a fixed version.