CVE-2026-63649

An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.

OpenVPN 2.7_alpha1 through 2.7.7 allows remote authenticated users to impersonate others via a crafted certificate subject field.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

OpenVPN version 2.3.12 and newer is vulnerable to unauthenticated Denial of Service of server via received large control packet. This issue is fixed in 2.3.15 and 2.4.2.

The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.

Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses.

OpenVPN versions 2.6.0 to 2.6.6 contain a use after free vulnerability that may lead to undefined behavior, leaking memory buffers, or remote code execution when sending network buffers to a remote peer.

OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a buffer overflow vulnerability when key-method 1 is used, possibly resulting in code execution.

In OpenVPN through 2.6.22 and 2.7.6, retransmissions of ACK packet ID allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow.