Access Server: CVE-2026-88964 domain search options vulnerability

Impact on Access Server: None.

Details:

OpenVPN Access Server uses OpenVPN for VPN connections. OpenVPN versions 2.7_alpha3 through 2.7.7 are vulnerable to an out-of-bounds memory read when processing malicious PUSH_UPDATE messages from a server.

A malicious or compromised, authenticated remote OpenVPN server can send a specially crafted PUSH_UPDATE response containing manipulated domain search options. This triggers an integer underflow and subsequent out-of-bounds memory read, potentially causing a denial-of-service (DoS) condition (application crash) or memory disclosure on the client.

However, Access Server doesn't currently support sending PUSH_UPDATE messages. Additionally, this vulnerability affects only OpenVPN clients running on Windows and Android, while Access Server runs as server on Linux.

Therefore, no exploitation path from Access Server is currently known. Remediation should focus on affected client devices rather than Access Server.

Remediation:

Although no exploitation path from Access Server is currently known, we recommend updating affected OpenVPN client software to version 2.7.8 or later to protect against this vulnerability. OpenVPN Connect isn't affected.

Need Help?

If you have questions, submit a support ticket.