OpenVPN 2.7.9 fixes two flaws in its Windows service

OpenVPN 2.7.9 fixes two flaws in its Windows service

5 November 2026: OpenVPN 2.7.9 fixes CVE-2026-121720 and CVE-2026-115342, two flaws in how the service on Windows starts the main OpenVPN program; no severity score has been published that we could read, and we have seen no report of exploitation. Anyone running the OpenVPN community client on Windows should plan the update.

Not yet independently verified. The OpenVPN project lists both CVEs under November 2026, but its per-CVE pages and release notes would not open, so the technical detail comes from Linuxiac. We have seen no CVSS score and do not know whether the 2.6 line gets fixes. We will update this when it can be confirmed, and remove this note.

The two bugs are about what crosses a privilege boundary

The OpenVPN service on Windows runs with higher rights than the user who asks it to start a connection. Both flaws sit at that boundary, which is why they matter on a shared or managed machine even though neither is described as remotely reachable.

CVE-2026-121720 is insufficient filtering of user-defined environment variables passed from the service to the main executable. These variables are now strictly validated.

CVE-2026-115342 concerns command-line parsing in the Windows service. Version 2.7.9 now validates improperly quoted arguments and uses the Windows CommandLineToArgvW() function in both the main executable and the interactive service, so the two read a command line the same way. A disagreement between two parsers is the classic way of getting an extra argument past a check.

Other hardening in the release

Two further changes reduce what an attacker could do with a similar bug later:

• plugin DLL dependencies can load only from trusted plugin, application and system directories;
• processes started through the interactive service run at high integrity level.

Non-security changes include Linux IFF_BACKPRESSURE support, a fix for parsing long usernames in auth-user-pass, compatibility with OpenSSL 4.1 and memory leak fixes in the Windows service.

Checking which OpenVPN you run

The project's list also carries four CVEs dated October 2026 (CVE-2026-88964, CVE-2026-84790, CVE-2026-115402 and CVE-2026-105390), which are separate from this release. A team that has not updated for a while should read those entries too.

Administrators should bear in mind where OpenVPN comes from on their estate. The community client is often deployed by hand, or bundled by a VPN provider inside its own Windows app, so it may not appear in the normal patch report. Search endpoints for openvpn.exe and for the interactive service rather than relying on the software inventory alone. Providers shipping a rebranded client should be asked which version they include.

Users on the 2.6 line should watch the project's announcements page, since we could not establish whether it receives the same fixes.

OpenVPN is one of 13 VPN products we list. Linux and macOS installs are not named in either CVE description, although the release carries non-security fixes for Linux.

Sources

• OpenVPN project: Security Announcements, entries for November 2026 (read 6 November 2026), 6 November 2026
• Linuxiac: OpenVPN 2.7.9 fixes two security vulnerabilities, 5 November 2026, 5 November 2026