Use-After-Free Vulnerability in OpenVPN Affects Various Versions
CVE-2026-84471

7.2HIGH

Key Information:

Vendor

Openvpn
Status
Openvpn
Vendor
CVE Published:
14 October 2026

What is CVE-2026-84471?

A use-after-free vulnerability exists in OpenVPN versions 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7. This flaw can be exploited by remote authenticated peers who send specially crafted packets during a TLS session promotion or expiry. Exploiting this vulnerability could result in denial of service or memory leakage, thus potentially compromising system stability and data integrity.

Affected Version(s)

OpenVPN 2.6.0 <= 2.6.22

OpenVPN 2.7_alpha1 <= 2.7.7

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.