CVE-2026-88964
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disc…
Published Oct 13, 2026 · updated Oct 14, 2026
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Catalog
Detected
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
Oct 14, 2026 · Catalog
Fix available
Debian:14 openvpn 0 → 2.7.8-1
Oct 14, 2026 · Catalog
Updated
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
Affected
- Debian:12 openvpn2.6.11-1, 2.6.12-1, 2.6.13-1
- Debian:13 openvpn2.6.14-1, 2.6.14-1+deb13u1, 2.6.14-1+deb13u2
- Debian:14 openvpn0 → 2.7.8-1
Sources
- CVE.orgCVE-2026-88964
Official CVE identifier
cve.org - NIST NVDCVE-2026-88964
An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
nvd.nist.gov - OSV.devDEBIAN-CVE-2026-88964osv.dev