OpenVPN: OpenVPN: Memory corruption and information disclosure vulnerability
Published Sep 7, 2026
5.9
MEDIUMCVSS 4.0
EPSS 0.12%
Description
An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.
Affected products
-
- Version 2.7_alpha1StatusaffectedConstraints<=2.7.6
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Red Hat statement
Important: This vulnerability affects the Windows Interactive Service component of OpenVPN, allowing local authenticated users to cause memory corruption or information disclosure. Red Hat's OpenVPN packages, available in Community Projects like Fedora and EPEL, are Linux-based and do not include the vulnerable Windows-specific service, thus are not directly impacted by this flaw.
References (6)
- https://access.redhat.com/security/cve/CVE-2026-78221 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2529297 Issue Tracking
- https://community.openvpn.net/Security%20Announcements/CVE-2026-78221 vendor-advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-72276 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-78221
- https://www.cve.org/CVERecord?id=CVE-2026-78221
Change history (0)
No recorded changes yet.