OpenVPN Addresses Seven Vulnerabilities, Including Cross-Platform and Windows-Specific Flaws
OpenVPN 2.7.7 has been released to fix seven security vulnerabilities, impacting its core reliability layer and Windows service components, with potential for DoS and unauthorized configuration execution.
The OpenVPN project has released version 2.7.7, a critical security update that resolves seven distinct vulnerabilities affecting both its cross-platform reliability layer and its Windows-specific service components. This release addresses issues ranging from denial-of-service conditions to buffer overreads and configuration bypasses, which could potentially allow attackers to execute unauthorized VPN configurations.
The most significant vulnerability, CVE-2026-84732, targets the reliability layer responsible for managing TLS handshakes and acknowledgment packets. This flaw, discovered by Mark Bregman of Fox-IT, stemmed from an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that could not legitimately be outstanding. As the reliability layer is shared across all supported operating systems, this fix benefits users on Linux, Windows, and macOS.
Six of the seven vulnerabilities are specific to Windows installations, highlighting accumulated weaknesses in OpenVPN's Windows service architecture. CVE-2026-84256 involves improper command-line quoting within the CreateProcess() function. When combined with a validation script and a rogue certificate authority, this could lead to unexpected behavior. A related issue, CVE-2026-84226, affected the tapctl utility, which previously invoked netsh.exe without specifying its full file path, creating an opportunity for binary hijacking or path abuse, as identified by BreachX Zero Day Labs.
Local privilege escalation and denial-of-service were also addressed. CVE-2026-82312 arose from the use of NULL discretionary access control lists (DACLs) on critical system objects, such as the service exit event and the netsh.exe guard semaphore. This allowed a local denial-of-service condition where one logged-in user could interfere with another user's OpenVPN session by manipulating these objects, though it primarily affects setups that skip interactive service or rely on the automatic Windows service.
Further Windows-specific issues were found in openvpnserv, the Windows service component. CVE-2026-78221 caused a buffer overread when processing internationalized domain names (IDNs) using UTF-8 encoding due to an incorrect NRPT domain size passed to a function. Additionally, CVE-2026-78043 revealed that openvpnserv's configuration path validation failed to block forward slashes, which Windows file-open APIs treat as valid path separators. This oversight could permit an attacker to bypass administrative restrictions and force OpenVPN to load an unauthorized configuration file.
The final Windows vulnerability, CVE-2026-81738, was an off-by-one error in the write_dhcp_search_str() function. Specially crafted DHCP search-domain options could cause a single-byte overflow in a temporary buffer, a bug credited to Andre Kropp and ChinhNguyen.
Beyond the CVE fixes, OpenVPN 2.7.7 includes a Linux-specific enhancement to validate netlink replies against originating requests, suggested by Joshua Rogers. The release also reduces the number of future keys retained in the EPOCH data-channel format from sixteen to four, aiming to reduce log noise and resource usage on high-throughput links. Several networking bug fixes for TCP handshakes, UDP checksum handling, and OpenSSL's HMAC key management are also included.
Administrators running OpenVPN on Windows are strongly advised to prioritize this update due to the concentration of local-privilege and configuration-bypass flaws. All users, however, will benefit from the patch to the core reliability layer. Detailed release notes and full CVE information are available on the OpenVPN Community Wiki's security announcements page.