The OpenVPN project has released version 2.7.7, a significant security update aimed at addressing seven vulnerabilities within its core reliability layer and Windows-specific services. This update, made available on September 3, 2026, aims to resolve issues such as denial-of-service threats, buffer overreads, and configuration bypasses, which could potentially allow unauthorized VPN configurations.
Key Security Enhancements
Among the updates, the most impactful fix, identified as CVE-2026-84732, focuses on OpenVPN’s reliability layer. This component, which is essential for managing TLS handshakes and acknowledgment packets, contained two bugs: an unbounded reliable TLS timeout and improper handling of acknowledgment packets. These vulnerabilities were discovered by security expert Mark Bregman from Fox-IT, benefiting deployments across Linux, Windows, and macOS.
Six of the seven identified vulnerabilities primarily affect Windows systems, highlighting specific weaknesses in OpenVPN’s Windows service architecture. These issues underscore the importance of the update for systems running on this platform.
Windows-Specific Vulnerabilities
The update also tackles CVE-2026-84256, which involved incorrect command-line quoting in the CreateProcess() function. This flaw could lead to unexpected behavior when combined with a validation script and rogue certificate authority. Another related issue, CVE-2026-84226, was found in the tapctl utility, where the netsh.exe was invoked without its full path, potentially leading to binary hijacking.
Additionally, CVE-2026-82312, which stems from the use of NULL discretionary access control lists (DACLs), could allow local denial-of-service attacks, where a user could interfere with another user’s OpenVPN session. This flaw affects setups that bypass interactive services or rely on automatic Windows service configurations.
Further Improvements and Recommendations
Other vulnerabilities include CVE-2026-78221, which caused a buffer overread due to incorrect processing of internationalized domain names, and CVE-2026-78043, which allowed unauthorized configurations due to improper path validation. The final Windows-specific vulnerability, CVE-2026-81738, addressed a buffer overflow issue in DHCP search-domain options.
Beyond these fixes, OpenVPN 2.7.7 also introduces a Linux-specific improvement enhancing netlink reply validation and reduces the number of retained future keys, thus improving efficiency on high-throughput links. Several networking bugs related to TCP handshakes and UDP checksum handling have also been addressed.
Administrators using OpenVPN on Windows are strongly advised to implement this update promptly due to the concentration of vulnerabilities affecting local privileges and configuration. Comprehensive details on these security changes can be found on the OpenVPN Community Wiki’s security announcements page.
