CVE-2026-115342 - Windows: Interactive service option validation bypass via command-line parsing mismatch
The Windows interactive service validates the options passed to it using CommandLineToArgvW(), while openvpn.exe relies on the C runtime to split its command line. Since Visual Studio 2008 the two parsers disagree on the handling of two consecutive double quotes inside a quoted string, so a crafted command line can hide restricted options from the interactive service validator while openvpn.exe still executes them. This bypasses the requirement that configuration files are only loaded from the locked-down OpenVPN configuration directory.
OpenVPN versions 2.4.0 through 2.7.8 are affected. This is fixed in version 2.7.9.
CVE Record: CVE-2026-115342
Github:
Release notes:
Reported-By: Heiko Hund