CVE-2026-84732: Integer Overflow
Published Sep 7, 2026
·Updated
Last updated 30 September 2026
Other sources
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow
— MITRE
Affected Software
2 affected componentsFixes available
OpenVPN OpenVPN<=2.6.22, <=2.7.6
debian/openvpn<=2.6.14-0+deb12u2, <=2.6.14-1+deb13u3
2.7.7-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/openvpnto a version that resolves this vulnerability.Fixed in 2.7.7-1
Event History
Sep 7, 2026
CVE Published
via MITRE·08:16 AM
Data Sourced
via MITRE·08:16 AM
DescriptionWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Sep 30, 2026
Data Sourced
via Launchpad·02:48 PM
Description
Data Sourced
via Debian·02:48 PM
DescriptionAffected Software
Oct 1, 2026
Data Sourced
via Ubuntu·02:48 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploiting this issue require OpenVPN authentication or valid user credentials?
No. The issue is described as exploitable by remote unauthenticated attackers using crafted inputs involving retransmitted ACK packet IDs.