CWE-412
AllowedUnrestricted Externally Accessible Lock
Abstraction: Base · Status: Incomplete
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.
11 vulnerabilities reference this CWE, most recent first.
GHSA-J6H9-44FX-3M85
Vulnerability from github – Published: 2026-09-07 09:31 – Updated: 2026-09-07 09:31OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects
{
"affected": [],
"aliases": [
"CVE-2026-82312"
],
"database_specific": {
"cwe_ids": [
"CWE-412"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-07T08:17:13Z",
"severity": "LOW"
},
"details": "OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects",
"id": "GHSA-j6h9-44fx-3m85",
"modified": "2026-09-07T09:31:39Z",
"published": "2026-09-07T09:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82312"
},
{
"type": "WEB",
"url": "https://community.openvpn.net/Security%20Announcements/CVE-2026-82312"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Use any access control that is offered by the functionality that is offering the lock.
Mitigation
Use unpredictable names or identifiers for the locks. This might not always be possible or feasible.
Mitigation
Consider modifying your code to use non-blocking synchronization methods.
CAPEC-25: Forced Deadlock
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.