Commit 348678
2026-11-12 12:21:40 flichtenheld: -/-| /dev/null .. Security Announcements/CVE-2026-115342.md | |
| @@ 0,0 1,15 @@ | |
| + | # CVE-2026-115342 - Windows: Interactive service option validation bypass via command-line parsing mismatch |
| + | |
| + | The Windows interactive service validates the options passed to it using `CommandLineToArgvW()`, while openvpn.exe relies on the C runtime to split its command line. Since Visual Studio 2008 the two parsers disagree on the handling of two consecutive double quotes inside a quoted string, so a crafted command line can hide restricted options from the interactive service validator while openvpn.exe still executes them. This bypasses the requirement that configuration files are only loaded from the locked-down OpenVPN configuration directory. |
| + | |
| + | OpenVPN versions 2.4.0 through 2.7.8 are affected. This is fixed in version 2.7.9. |
| + | |
| + | CVE Record: [CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342) |
| + | |
| + | Github: |
| + | * [OpenVPN/openvpn-private-issues#184](https://github.com/OpenVPN/openvpn-private-issues/pull/184) |
| + | |
| + | Release notes: |
| + | * [openvpn-2.7.9](https://community.openvpn.net/ReleaseHistory#openvpn-279-released-5-november-2026) |
| + | |
| + | Reported-By: Heiko Hund |