OpenVPN CVE-2026-82312

Exploitation requires a low-privileged local account on the same Windows host as victim OpenVPN sessions. The essential gatekeeping condition is that OpenVPN must be running without the Interactive Service (iservice) - either started manually by the user or via the automatic Windows service mode. Deployments using the iservice (the recommended configuration for multi-user environments) are completely unaffected by this CVE. Meaningful impact further requires that multiple users are running OpenVPN concurrently on the same machine; single-user hosts face only self-inflicted disruption. What limits exploitation: entirely local attack surface with no remote or network vector, a specific non-default or legacy configuration required (absence of iservice), no confidentiality or integrity impact whatsoever, and no privilege escalation beyond the ability to disrupt peer sessions.

The vendor CVSS 4.0 score of 1.8 (AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H) accurately reflects the narrow conditions under which exploitation is meaningful. AT:P (Attack Target Presence required) captures the essential precondition - the iservice must not be in use - which substantially limits the exposed population to legacy or manually managed Windows deployments. SA:H reflects the ability to disrupt all VPN sessions on the same host, which carries real operational weight in shared environments such as RDS or terminal servers. No CISA KEV listing exists and no public exploit code has been identified; negligible automated exploitation probability is expected given the local-only attack vector. No EPSS data was provided, consistent with inferred negligible risk. Typical enterprise deployments where the iservice is standard practice are not meaningfully exposed, though environments without iservice should patch at their next maintenance cycle.

A low-privileged local user on a shared Windows RDS or terminal server running OpenVPN sessions without the iservice calls standard Windows API functions to open and acquire the world-accessible named netsh.exe guard semaphore. With the semaphore held, every other OpenVPN client process on the host that attempts to invoke netsh.exe for interface setup, DNS configuration, or routing changes blocks indefinitely, stalling or terminating those users' VPN sessions. No public exploit code exists; the attack requires only unprivileged Windows API calls available to any standard user account.