CVE-2026-78221
Received Received - Intake

Buffer Overflow in OpenVPN Windows Interactive Service

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: OpenVPN Inc.

Description
An incorrect buffer size calculation in the Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to cause memory corruption or disclose sensitive information via crafted NRPT inputs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-78221
EUVD
EUVD-2026-72276

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
openvpn openvpn From 2.7.0 (inc) to 2.7.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an incorrect buffer size calculation in the Windows Interactive Service of OpenVPN versions 2.7_alpha1 through 2.7.6. It allows local authenticated users to cause memory corruption or disclose sensitive information by sending crafted NRPT inputs.

Detection Guidance

Detection of CVE-2026-78221 requires checking for vulnerable OpenVPN versions (2.7_alpha1 through 2.7.6) and inspecting NRPT inputs for crafted data. No specific commands are provided in the context. Review OpenVPN logs for memory corruption or information disclosure events.

Impact Analysis

The vulnerability may allow attackers with local access to corrupt memory or access sensitive data on affected systems. This could lead to unauthorized information disclosure or system instability.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, which may violate GDPR or HIPAA requirements for data protection and confidentiality. Organizations using affected OpenVPN versions may face compliance risks.

Mitigation Strategies

Update OpenVPN to a version that fixes the incorrect buffer size calculation in the Windows Interactive Service. Avoid using vulnerable versions 2.7_alpha1 through 2.7.6.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78221. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart