OpenVPN 2.7.7 fixes a control-channel DoS and multiple Windows security flaws

OpenVPN published 2.7.7 on September 3 after its maintainers said the release was being held for an important denial-of-service fix. CVE-2026-84732 affects OpenVPN 2.6.22 and 2.7.6 and allows an attacker to potentially disrupt the control-channel reliability layer by driving the reliable TLS retransmission timeout to grow without bound or by sending acknowledgements for packets that cannot be outstanding. The same release also fixes multiple Windows-specific security defects, including a `CreateProcess()` command-line quoting bypass, a local denial of service caused by NULL DACLs on service synchronization objects, an `openvpnserv` UTF-8/IDN buffer overread and a configuration-path validation bypass. OpenVPN’s official download directory contains 2.7.7 source and Windows installer artifacts dated September 3.

OpenVPN often sits on a privileged network boundary, so even defects that require unusual conditions deserve faster treatment than an ordinary client update. CVE-2026-84732 is especially relevant because it targets the protocol reliability machinery rather than a local Windows integration and can potentially cause denial of service. The Windows issues have narrower prerequisites, but they touch privileged service behavior, command construction and configuration validation. Operators should therefore distinguish between the cross-platform control-channel exposure and the additional Windows-only risks while planning upgrades.

OpenVPN says CVE-2026-84732 can let attackers manipulate reliability-layer state in two ways: causing the reliable TLS retransmission timeout to grow without bound or acknowledging packets that could not legitimately still be outstanding. The affected versions are 2.6.22 and 2.7.6, with 2.7.7 carrying the fix.

CVE-2026-84256 affects a broad range of Windows OpenVPN 2.x versions. OpenVPN says command lines passed to `CreateProcess()` were not correctly quoted for characters special to `cmd.exe`; in combination with a validation script and a rogue CA, this could make OpenVPN misbehave. The issue is fixed in 2.7.7.

2.7.7 also fixes CVE-2026-82312, where NULL DACLs on service synchronization objects allowed local interference with other users’ OpenVPN processes, along with a UTF-8/IDN buffer overread in `openvpnserv` and a path-validation mismatch that could let a local user select an administratively disallowed configuration file.

OpenVPN’s build repository lists the 2.7.7 source tarball and Windows x86, amd64 and arm64 installers dated September 3. Operators should verify the exact package channel used by their distribution or appliance rather than assuming every downstream repository has already moved to 2.7.7.