OpenVPN 2.7.9 Fixes Two Windows Service CVEs and Tightens DLL Security

The project's own release history uses the same short description it has used for recent maintenance releases: a bugfix release "fixing several security issues." Linux readers also get new behavior: TUN/TAP backpressure support and a change to how existing network interfaces are updated.

The two CVEs: where the Windows service hands off to the main binary​

Both vulnerabilities are in the handoff between the privileged Windows service and the main OpenVPN executable.

CVE-2026-121720: environment variable filtering. Linuxiac reports that the release fixes CVE-2026-121720, a Windows-specific vulnerability involving insufficient filtering of user-defined environment variables passed by the OpenVPN service to the main executable. The OpenVPN release notes describe the fix in one line: openvpnserv now strictly filters user-defined environment variables before passing them to openvpn.exe.

CVE-2026-115342: command-line quoting. The project's changelog covers this one in two parts:

• The interactive service now validates the command line more robustly to block attacks that use invalid quoting.
• openvpn.exe now parses its command line with CommandLineToArgvW(), the same Windows function the interactive service uses.

The second change matters because of a common bug pattern. This explanation is general security knowledge, not detail from the project. If one component checks a command line using one set of parsing rules and another component runs it using different rules, an attacker can try to build a string that passes the check but means something else when it runs. Using the same parser in both places removes that gap.

OpenVPN credits Heiko Hund with finding both issues. Warp2Search and Linux Compatible also say the update includes two new CVEs identified by researcher Heiko Hund.

Some details are still missing. Linux Compatible notes that both were disclosed privately through the project's GitHub issues, so full technical detail was still missing at release time. The release notes do not give CVSS scores or say whether either issue has been exploited. One aggregator described the bugs as "critical vulnerabilities," but no published severity rating supports that label. The fixes still deserve prompt attention, but don't rank them by a score that hasn't been published.

More Windows hardening outside the CVEs​

The same Windows security section of the release notes includes two more changes:

1. Restricted DLL loading. Plugin dependencies (DLLs) can now load only from the plugin, application, and system directories. This narrows the DLL search path, a long-standing way for attackers to plant a malicious library that a trusted process loads.
2. High integrity level. Linuxiac reports that OpenVPN processes started through the interactive service now run at a high integrity level, protecting their process memory and threads against tampering. The project adds that signals and events are still allowed, so normal control of the tunnel keeps working.

The release also fixes several reliability problems in the Windows service:

• Message sizes are now validated in the DNS, NRPT, and WINS handlers.
• Plugin paths that are too long are now detected.
• Interface names are now null-terminated in the address and route handlers.
• A memory leak in an error path of windows_set_mtu() is fixed.

The MSI installer has its own changes since 2.7.8-I001. It sets permissions (ACLs) more reliably when OpenVPN is installed outside "Program Files," where the intended ACLs were not always applied before. It also bundles OpenVPN GUI 11.67.

Context: a run of Windows service fixes​

This is not a one-off. The project's release history shows a steady series of Windows fixes in recent months:

• 2.7.7 (September): fixed CreateProcess() command-line quoting for characters that cmd.exe treats as special, stopped using NULL DACLs on system objects, and blocked / in config paths to stop a path-validation bypass.
• 2.7.8 (October 7): stopped cmd.exe from expanding variables in quoted arguments (CVE-2026-84256) and updated the bundled dco-win driver to fix a local denial-of-service deadlock (CVE-2026-105390).

Our reading, based on that pattern: the interactive service is under close scrutiny, and the maintainers are closing the bridge between a SYSTEM-level service and user-supplied input one layer at a time. That's good news. It also means Windows admins who skip OpenVPN updates fall behind on several fixes at once.

Section summary: Both CVEs and most of the hardening are Windows-only. They target how the privileged service passes environment variables and command lines to openvpn.exe, which DLLs it can load, and how well the process is protected.

Linux: backpressure instead of dropped packets​

On Linux, 9to5Linux reports that 2.7.9 adds support for setting the IFF_BACKPRESSURE flag on Linux (if available) to help the kernel TUN/TAP to apply proper prioritization (qdisc, etc.) to incoming packets if userspace is slow to process them. Without this flag, the kernel would just drop everything.

In practice, if OpenVPN falls behind under heavy load, the kernel's queuing disciplines can now decide which traffic waits instead of dropping it all. "Where available" means it depends on kernel support.

Linuxiac also highlights a maintenance change: OpenVPN now uses RTM_SETLINK instead of RTM_NEWLINK when updating existing interfaces. The project files this under long-term code maintenance, not as a user-facing feature.

To be clear: neither Linux change fixes either CVE. Updating a Linux server does not address the Windows interactive service flaws. Windows clients need their own update.

Login and GUI improvements​

Two changes affect how users sign in.

Long usernames. The release notes say that reading credentials from an --auth-user-pass file, or from an inline config, left part of an overlong username in the password field. That is now fixed.

Username prefill. Tux Machines describes the old behavior: if an OpenVPN config has a username set but no password, and OpenVPN wants to prompt for the password, the GUI couldn't see the username today and prompted for both. Now, 9to5Linux reports, OpenVPN sends a hint to the management interface, so a GUI can pre-fill the username field, or only prompt for the password.

The username hint is only sent when the management client reports compatibility level 6 or higher. OpenVPN also enlarged the buffer for this message so long usernames fit. The bundled OpenVPN GUI 11.67 already supports the feature. Third-party front ends that use the management interface will need to add it.

Key handling and other fixes​

The release also includes smaller security and reliability fixes:

• Key material cleanup: 9to5Linux reports the release includes wiping key material with secure_memzero(), no longer looking up the "none" cipher in OpenSSL, wiping the server secret key after loading it, and no longer writing the journal file through symlinks or hardlinks.
• CRL handling: skipping the "none" cipher lookup keeps a stray error off OpenSSL's error stack. That stray error could otherwise cause misleading SSL error messages when loading a certificate revocation list (CRL).
• Port-share: besides the symlink and hardlink protection, the project now documents how the port-share directory should be set up.
• Config and routing: the --extra-certs access check is fixed, along with handling of IPv6 DNS servers supplied by DHCP and missing gateway details in route output.
• OpenSSL 4.1: OpenVPN now uses ASN1_STRING_get_length() and falls back to ASN1_STRING_length() on older SSL libraries.

What Windows administrators should do​

There's nothing to reconfigure. Install the new version.

1. Check your version. Run openvpn --version from an elevated or standard prompt in the OpenVPN bin directory, or check Installed Apps. Any 2.7.x below 2.7.9 lacks these fixes.
2. Pick the right installer. Linux Compatible notes that 64-bit, 32-bit, and ARM64 MSI installers plus a signed source tarball are available. The 64-bit and ARM64 packages are named OpenVPN-2.7.9-I001-amd64.msi and OpenVPN-2.7.9-I001-arm64.msi.
3. Verify the signature. Each installer has a matching GnuPG signature. Check it before rolling the MSI out across your fleet.
4. Deploy at scale. It's a standard MSI, so you can push it through your usual tools, such as Intune, Configuration Manager, or Group Policy software installation. Test on a pilot group first.
5. Confirm the service restarted. After upgrading, run Get-Service *openvpn* in PowerShell to check that the interactive service is running, then test a connection.
6. Re-check custom install paths. If OpenVPN lives outside "Program Files," the installer's ACL fix applies to you. Verify that only administrators can write to the directory.
7. Test your plugins. Plugins that load helper DLLs from unusual locations may break under the new DLL restrictions. Move those DLLs into the plugin, application, or system directories.

For Linux, 9to5Linux advises that if you're not compiling OpenVPN from source, do install this update from your distro's repositories. Distribution packages often lag upstream releases, so check your repository before assuming you're current.

One more point from Linux Compatible: OpenVPN Inc.'s commercial products are a different product entirely and not part of this community release, so keep the two apart. If your organization uses the commercial Connect client, check that vendor's own advisories. The 2.7.9 MSI does not cover it.

The bottom line​

OpenVPN 2.7.9 is a modest-looking update with two real Windows CVEs, and both target the boundary between a privileged service and untrusted input. The DLL restrictions and high-integrity-level change add defense in depth. Linux users get better behavior under heavy load, and anyone who keeps a username in a config file gets a better login prompt.

On Windows, update now. No severity score or exploitation details have been published yet. With fixes for the interactive service arriving roughly every month, the safest approach is to keep OpenVPN on the latest release.