EUVD-2026-100755
GHSA-wm7f-2ghj-7r8c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInduce client to connect to attacker-controlled OpenVPN server
-
ExploitPush crafted options clearing domain_search_list
-
ExecutionTrigger unsigned underflow causing out-of-bounds read
-
ImpactLeak client memory or crash client
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the OpenVPN client to establish a TLS session with a malicious or compromised server that then pushes a crafted option combination affecting domain_search_list, causing an unsigned underflow and out-of-bounds read; this is a client-side bug, not a flaw in a server listening for inbound connections. Limiting factors: the attacker must control or impersonate the server the victim connects to (the client must trust and connect to that endpoint - reflected by PR:L), exploitation only affects OpenVPN versions before 2.7.8, and impact is primarily client crash/DoS with limited memory disclosure rather than code execution. |
| Impact | The vendor CVSS 4.0 base score is 7.1 (High), driven by AV:N/AC:L/PR:L/UI:N with limited confidentiality impact (VC:L) and high availability impact (VA:H) - consistent with CWE-125 (out-of-bounds read) producing a memory leak and/or client crash. This is a client-side flaw triggered by server-pushed options, so the practical attacker is a malicious or compromised OpenVPN server rather than an arbitrary internet host; PR:L reflects that the attacker must be an authenticated TLS peer the client has chosen to connect to, which meaningfully narrows the exploitation population. Exploitation status is 'no public exploit identified at time of analysis' - the CVE is NOT in CISA KEV and no POC is referenced, and no EPSS probability was supplied in the input, so quantitative exploitation likelihood cannot be stated. Net assessment: a legitimate but moderate priority - availability-focused with only minor info disclosure, patched in OpenVPN 2.7.8, and gated on the victim connecting to an attacker-controlled endpoint rather than being remotely exploitable against a default-listening service. Note a data artifact: the release notes hyperlink for this entry points to 'CVE-2026-84964' while the tracked ID is CVE-2026-88964, an apparent upstream typo - verify the canonical ID with the vendor advisory. |
| Exploit ScenarioDerived | A victim OpenVPN client connects to a malicious or compromised server, which pushes a crafted option set that triggers an unsigned integer underflow while the client clears its domain_search_list. The resulting out-of-bounds read discloses adjacent process memory and/or crashes the client (denial of service). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds read in the OpenVPN client before 2.7.8 can be triggered when the client establishes a TLS session with a malicious or compromised server that pushes a crafted option combination touching domain_search_list, producing an unsigned integer underflow that leads to a limited memory disclosure and a high-availability-impact client crash. The defect is client-side rather than a flaw in a server accepting inbound connections, and exploitation requires the attacker to control or impersonate the endpoint the victim connects to (the assessed CVSS 3.1 vector carries PR:L for exactly this reason). There is no public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 base score is 7.1 (VC:L/VA:H) and the vendor-released fix is OpenVPN 2.7.8.
RemediationAI
Deploy the vendor-released patch: upgrade OpenVPN clients to 2.7.8 or later, as documented at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8 and https://community.openvpn.net/Security%20Announcements/CVE-2026-88964; the fix removes the unsigned underflow when clearing domain_search_list and therefore eliminates the out-of-bounds read. Where immediate fleet-wide upgrade is not feasible, reduce the trust boundary the attack depends on: restrict clients to connecting only to VPN servers you operate and can strongly authenticate, and pin or strictly verify server identity (certificate pinning, tls-verify, and tls-crypt/tls-crypt-v2 where applicable) so a rogue or impersonated endpoint cannot push the crafted option set - the trade-off is that pinning and strict verification break legitimate server certificate rotation and failover and must be updated in lockstep with server-side changes. Narrowing the pushed option surface, for example by not enabling server-pushed domain search list handling where it is not required in your topology, reduces but does not eliminate exposure if the feature is needed. Because exploitation manifests as an unexpected client crash or dropped tunnel, monitor and alert on anomalous client termination, and note that the same 2.7.8 release tightens NULL-byte handling in certificate subjects (CVE-2026-84790), which can cause previously working OpenSSL-based PKI setups to fail validation - test on a pilot group before rolling out fleet-wide, and plan for certificate reissuance if carriers contain such subjects.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-88964 is a CWE-125 out-of-bounds read rooted in an unsigned integer underflow in OpenVPN's option-handling code, specifically the path that clears the domain_search_list when processing options received from the peer. OpenVPN pushes configuration options from server to client during TLS session setup; a malicious or compromised server can push a crafted option combination that drives the list-clearing logic below zero on an unsigned counter/length, after which the code reads past the intended buffer - this corresponds to the vendor release note 'options: fix unsigned underflow when clearing domain_search_list' in the 2.7.8 tag. Impact is bounded: the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H indicates limited confidentiality exposure from the out-of-bounds read plus a client crash, not code execution or integrity loss. The same 2.7.8 release bundles related hardening that should not be conflated with this CVE: stricter rejection of certificates containing NULL bytes in subject fields (CVE-2026-84790, a user-visible behavior change that may break existing OpenSSL-based installations), a tls-crypt-v2 client-side handling fix for ill-behaving servers (no CVE assigned per the vendor's CRA-based reasoning), and a win32 fix preventing cmd.exe from expanding variables in quoted arguments (CVE-2026-84256). No CPE strings were supplied in the input data, so affected scope is derived from the vendor release rather than a CPE-matched inventory.
Know when Openvpn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Attacker must be a connected TLS peer (malicious server) so PR:L; out-of-bounds read yields minor info leak (C:L) and client crash (A:H) with no integrity impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
OpenVPN client deployments prior to 2.7.8 are exposed to a vulnerability that can be triggered by a malicious or compromised VPN endpoint, resulting in limited memory disclosure and a client crash for the connecting user. Because exploitation requires an attacker to control or impersonate the server the user connects to, the primary organizational concern is availability disruption for remote and hybrid staff rather than broad, opportunistic compromise. Leadership should care because unpatched endpoints represent a persistent connectivity and information-exposure risk for the remote workforce that is fully resolvable with a vendor-released update.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. Rated critical sev
OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control
OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%\OpenVPN Connect\drivers\tap\amd64\win10,
openvpnserv.exe (aka the interactive service helper) in OpenVPN 2.4.x before 2.4.6 allows a local attacker to cause a do
CRLF injection vulnerability in the web interface in OpenVPN Access Server 2.1.4 allows remote attackers to inject arbit
Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in OpenVPN Access Se
Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execut
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malic
Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpn_users endpoin
OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1
tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which a
OpenVPN plug-ins on Windows with OpenVPN 2.6.9 and earlier could be loaded from any directory, which allows an attacker
Exploit-DB