CVE-2026-88964: Integer Underflow
Published Oct 13, 2026
·Updated
An integer underflow in OpenVPN version 2.7alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options
Affected Software
1 affected component
OpenVPN OpenVPN>=2.7_alpha3<=2.7.7
Event History
Oct 13, 2026
CVE Published
via MITRE·10:15 PM
Data Sourced
via MITRE·10:15 PM
DescriptionWeakness
Frequently Asked Questions
1
Which deployments should be prioritized for review?
Prioritize OpenVPN installations on Windows and Android running versions 2.7_alpha3 through 2.7.7. The provided information identifies those platforms and versions as affected.
2
What access does an attacker need to exploit this issue?
An attacker needs to be a remote authenticated server and provide crafted domain search options to the OpenVPN client.