By ByteBot
OpenVPN 2.7.7 landed on September 3 with fixes for seven CVE-tracked vulnerabilities. Five of those seven affect Windows deployments, targeting the tapctl utility, the openvpnserv service, and a NULL DACL flaw that grants any local user unrestricted access to protected system objects. There is no configuration workaround for any of them — the fix is the upgrade.
The Windows CVE Stack
If you run OpenVPN on Windows, this release is not optional. Here is what was fixed:
CVE-2026-82312 is the one to understand first. OpenVPN was creating several system objects with NULL DACLs. In Windows, a NULL DACL does not mean “no access” — it means every user and process on the system has unrestricted access to that object. OpenVPN was effectively publishing a set of system objects to everyone on the machine.
CVE-2026-84256 fixes incorrect command-line quoting in CreateProcess() calls. Characters that cmd.exe treats as special — ampersands, pipes, redirects — were not properly quoted, creating a potential command injection path for anyone who could influence VPN configuration paths.
CVE-2026-78221 affects openvpnserv: internationalized domain names encoded as UTF-8 could cause an incorrect NRPT domain size to be calculated, potentially triggering a buffer overread in the service.
CVE-2026-78043 allowed a forward slash in configuration paths handled by openvpnserv — a path traversal-class issue that could let a crafted config file reference files outside its intended directory.
CVE-2026-84226 affects the tapctl utility, which manages the TAP virtual network adapter on Windows. The utility runs with elevated permissions during adapter management operations, making any flaw here worth taking seriously.
Cross-Platform: Reliability Layer and Buffer Guard
Two CVEs affect all platforms — Linux, macOS, and Windows alike.
CVE-2026-84732 addresses two separate problems in OpenVPN’s reliability layer — the component responsible for guaranteed delivery over UDP. Reliability layer bugs can cause connection instability or, in edge cases, leave the connection in an exploitable state.
CVE-2026-81738 fixes an off-by-one error in the buffer guard used by write_dhcp_search_str(). Off-by-one buffer errors are the kind that look harmless in code review and show up in exploit databases later.
Linux Netlink Hardening
This one is not a CVE but matters for container users. OpenVPN uses the Linux Netlink interface to manage routing and network interfaces. In 2.7.7, the client now validates Netlink replies against the original request — it no longer blindly trusts whatever comes back on the Netlink socket.
This is relevant if you run OpenVPN inside Docker containers, Kubernetes pods, or LXC instances where network namespaces can be shared or manipulated. It is a defense-in-depth improvement, not a critical fix, but it closes a class of attack that matters in multi-tenant environments.
How to Upgrade
Check your current version first: openvpn --version. If it is anything below 2.7.7, upgrade now.
# Debian / Ubuntu
sudo apt update && sudo apt upgrade openvpn
# RHEL / Fedora / Rocky
sudo dnf update openvpn
# macOS (Homebrew)
brew update && brew upgrade openvpn
# Verify the installed version
openvpn --versionWindows users should download the updated installer from openvpn.net/downloads or use OpenVPN’s official software repositories for package-manager-based upgrades. Access Server users have a separate upgrade path — consult the Access Server documentation.
Bottom Line
Seven CVEs in a single patch release is a heavy security payload for a mature project like OpenVPN. The NULL DACL flaw alone — handing every local process unrestricted access to system objects — is enough reason to push this update today. The path traversal and buffer overread issues in openvpnserv make the Windows case more urgent still.
If OpenVPN is in your network stack, the upgrade cannot wait. The official release history and full GitHub changelog have the complete details on every fix included in this release.
