The OpenVPN project has shipped version 2.7.7, a security-focused release that patches seven distinct vulnerabilities spanning the software’s core reliability layer and its Windows-specific service components.
The update, released on September 3, 2026, addresses issues ranging from denial-of-service conditions to buffer overreads and configuration bypasses that could allow attackers to run unauthorized VPN configurations.
The most broadly impactful fix, tracked as CVE-2026-84732, targets OpenVPN’s reliability layer, a component responsible for managing TLS handshakes and acknowledgment packets.
The flaw combined two separate bugs: an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that could never legitimately be outstanding. Both issues were discovered by security researcher Mark Bregman of Fox-IT, and since the reliability layer is shared across all supported platforms, the fix benefits Linux, Windows, and macOS deployments alike.
Six of the seven vulnerabilities specifically affect Windows installations, reflecting how deeply OpenVPN’s Windows service architecture had accumulated edge-case weaknesses.
OpenVPN Fixes 7 Security Flaws
CVE-2026-84256 involved incorrect command-line quoting in the CreateProcess() function, where characters with special meaning to cmd.exe could, in combination with a validation script and a rogue certificate authority, lead to unexpected behavior.
A related flaw, CVE-2026-84226, affected the tapctl utility, which previously invoked netsh.exe without specifying its full file path, a gap that researchers at BreachX Zero Day Labs identified using their Typhon AI Mil v2 tooling.
Local privilege abuse was also on the table. CVE-2026-82312 stemmed from OpenVPN’s use of NULL discretionary access control lists (DACLs) on system objects, including the service exit event and the netsh.exe guard semaphore.
This design flaw enabled a local denial-of-service scenario in which one logged-in user could interfere with another user’s OpenVPN session by blocking the semaphore or triggering spurious events, though the issue applies only to setups that skip the interactive service or rely on the automatic Windows service.
Two additional Windows flaws affected openvpnserv, the Windows service component. CVE-2026-78221 caused a buffer overread when internationalized domain names using UTF-8 encoding were processed, because the NRPT domain size passed to the function was incorrect.
Separately, CVE-2026-78043 revealed that openvpnserv’s configuration path validation failed to block forward slashes, even though Windows file-open APIs treat them as valid path separators. This mismatch could let an attacker slip past administrative restrictions and force openvpn.exe to launch a configuration file it was never authorized to run.
Rounding out the list, CVE-2026-81738 fixed an off-by-one error in write_dhcp_search_str(), where specially crafted DHCP search-domain options could overflow a temporary buffer by a single byte, a bug credited to researchers Andre Kropp of Nexory and ChinhNguyen.
| CVE ID | Component | Platform | Issue Type | Impact |
|---|---|---|---|---|
| CVE-2026-84732 | Reliability layer | All platforms | Unbounded reliable TLS timeout + acking non-outstanding packets | Potential DoS via TLS handshake mishandling |
| CVE-2026-84256 | CreateProcess() | Windows | Improper command-line quoting of cmd.exe special characters | Misbehavior when combined with validation script + rogue CA |
| CVE-2026-84226 | tapctl utility | Windows | netsh.exe invoked without full path | Potential binary hijacking/path abuse |
| CVE-2026-82312 | Service exit event / netsh guard semaphore | Windows | NULL DACL on system objects | Local DoS — one user can interfere with another user’s OpenVPN process |
| CVE-2026-78221 | openvpnserv | Windows | Incorrect NRPT domain size with UTF-8 IDN domains | Buffer overread |
| CVE-2026-78043 | openvpnserv | Windows | Config path validation doesn’t block ‘/’ separator | Bypass of admin-restricted config paths, unauthorized config execution |
| CVE-2026-81738 | write_dhcp_search_str() | Windows | Off-by-one in temp buffer guard | Single-byte buffer overflow via crafted DHCP options |
Beyond the CVE fixes, OpenVPN 2.7.7 adds a Linux-specific improvement that validates netlink replies against the originating request, an enhancement suggested by researcher Joshua Rogers.
The release also reduces the number of future keys retained under the EPOCH data-channel format from sixteen to four, easing log noise and resource usage on high-throughput links, alongside several networking bug fixes affecting TCP handshakes, UDP checksum handling, and OpenSSL’s HMAC key management.
Administrators running OpenVPN on Windows should prioritize this update given the concentration of local-privilege and configuration-bypass flaws, while all users benefit from the reliability-layer patch. The release notes and full CVE details are published on the OpenVPN Community Wiki’s security announcements page.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post OpenVPN Fixes 7 Security Flaws Affecting VPN Connections and Windows Systems appeared first on Cyber Security News.