Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-07T07:28:14 OpenVPN: OpenVPN: Memory corruption and information disclosure vulnerability 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:H CWE-120

An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.

A flaw was found in OpenVPN. An incorrect buffer size calculation within the Windows Interactive Service allows local authenticated users to trigger memory corruption or disclose sensitive information. This vulnerability can be exploited by providing specially crafted inputs.

Important: This vulnerability affects the Windows Interactive Service component of OpenVPN, allowing local authenticated users to cause memory corruption or information disclosure. Red Hat's OpenVPN packages, available in Community Projects like Fedora and EPEL, are Linux-based and do not include the vulnerable Windows-specific service, thus are not directly impacted by this flaw. https://www.cve.org/CVERecord?id=CVE-2026-78221 https://nvd.nist.gov/vuln/detail/CVE-2026-78221 https://community.openvpn.net/Security%20Announcements/CVE-2026-78221