Integer Underflow Vulnerability in OpenVPN on Windows and Android
CVE-2026-88964

7.1HIGH

Key Information:

Vendor

Openvpn
Status
Openvpn
Vendor
CVE Published:
13 October 2026

What is CVE-2026-88964?

An integer underflow vulnerability exists in OpenVPN versions 2.7_alpha3 through 2.7.7 on Windows and Android platforms. This flaw allows remote authenticated servers to exploit crafted domain search options, leading to potential denial of service or memory disclosure. Organizations utilizing affected versions should review security advisories and apply necessary updates to mitigate risks.

Affected Version(s)

OpenVPN Windows 2.7_alpha3 <= 2.7.7

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.