CVE-2018-9336

openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a double-free of memory by sending a malformed request to the interactive service. This could cause a denial-of-service through memory corruption or possibly have unspecified other impact including privilege escalation.

• CWE-415

• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.568761Mailing List, Third Party Advisory
• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24Release Notes, Vendor Advisory
• https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79bPatch, Third Party Advisory
• https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6Release Notes, Third Party Advisory
• https://www.tenable.com/security/research/tra-2018-09Exploit, Third Party Advisory
• http://www.slackware.com/security/viewer.php?l=slackware-security&y=2018&m=slackware-security.568761Mailing List, Third Party Advisory
• https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24Release Notes, Vendor Advisory
• https://github.com/OpenVPN/openvpn/commit/1394192b210cb3c6624a7419bcf3ff966742e79bPatch, Third Party Advisory
• https://github.com/OpenVPN/openvpn/releases/tag/v2.4.6Release Notes, Third Party Advisory
• https://www.tenable.com/security/research/tra-2018-09Exploit, Third Party Advisory

Published

May 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9330register.jsp in Coremail XT3.0 allows stored XSS, as demonst…
• CVE-2018-9331An issue was discovered in zzcms 8.2. user/adv.php allows re…7.5
• CVE-2018-9332K7Computing Pvt Ltd K7AntiVirus Premium 15.01.00.53 is affec…7.8
• CVE-2018-9333K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affecte…7.8
• CVE-2018-9334The PAN-OS management web interface page in PAN-OS 6.1.20 an…
• CVE-2018-9335The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN…
• CVE-2018-9337The PAN-OS web interface administration page in PAN-OS 6.1.2…
• CVE-2018-9338In ResStringPool::setTo of ResourceTypes.cpp, there is a pos…7.8
• CVE-2018-9339In writeTypedArrayList and readTypedArrayList of Parcel.java…7.8
• CVE-2018-9340In ResStringPool::setTo of ResourceTypes.cpp, it's possible …5.5
• CVE-2018-9341In impeg2d_mc_fullx_fully of impeg2d_mc.c there is a possibl…7.8
• CVE-2018-9344In several functions of DescramblerImpl.cpp, there is a poss…7.8