CVE-2026-88964

7.1High

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-125, CWE-191

Impact

A malicious or compromised OpenVPN server can crash client connections or leak client memory. The attacker only needs an active connection from an affected client.

Root cause

An integer underflow when parsing crafted domain search options triggers an out-of-bounds memory read.

Affected systems

OpenVPN 2.7_alpha3 through 2.7.7 on Windows and Android

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade OpenVPN beyond version 2.7.7 once available; as a temporary mitigation, do not connect to untrusted or third-party OpenVPN servers.

shell

$ openvpn --version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options

References

https://community.openvpn.net/Security%20Announcements/CVE-2026-88964

Source: nvd.nist.gov/vuln/detail/CVE-2026-88964