OpenVPN CVE-2026-84790

Exploitation requires an OpenSSL-based OpenVPN build older than v2.7.8 using certificate-based authentication, and a peer that presents an X.509 certificate containing an embedded NULL byte in the subject field; the NULL byte causes subject-name parsing to truncate, allowing a crafted certificate to be accepted as 'valid'. Limiting factors: mbedTLS builds are NOT affected (they always rejected such certificates), the attacker must supply a specially crafted certificate (reflected in AC:H and the AT:P attack requirement), and PR:L indicates some position or privilege is assumed rather than fully anonymous unauthenticated access. Deployments on v2.7.8+ or mbedTLS builds are not exploitable.

This is a certificate-validation flaw (CWE-158, NULL-byte neutralization) in OpenVPN's handling of X.509 certificate subjects, carrying a vendor CVSS 4.0 base score of 7.6 (High). The vector (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H) signals a network-reachable issue but with meaningful friction: high attack complexity (AC:H), a present attack requirement (AT:P), and some privilege/position (PR:L). No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no POC/exploit-code signal is present, so this is 'no public exploit identified at time of analysis' - do not treat it as actively exploited. The combination of AC:H + AT:P plus the need for an OpenSSL-based build and certificate-based authentication means real-world risk is lower than the 7.6 headline suggests: this is a conditions-dependent impersonation/validation-bypass bug rather than a wormable mass-exploitation issue. Signals are internally consistent (high confidentiality/integrity impact matches a cert-spoofing/impersonation outcome), but no EPSS/KEV/POC telemetry means prioritization should lean on deployment footprint and patch urgency rather than confirmed exploitation. Note: only a CVSS 4.0 vector was provided - no CVSS 3.1 vector was supplied by the source.

An attacker crafts an X.509 certificate whose subject embeds a NULL byte (e.g. CN 'trusted.example.com\0attacker.com'); a vulnerable OpenSSL-based OpenVPN peer reads only the truncated 'trusted' portion and accepts the certificate as valid, enabling impersonation and interception of VPN traffic. No public exploit is identified at time of analysis, and exploitation is non-trivial (AC:H/AT:P) because it depends on certificate-based authentication and an OpenSSL build.