CVE-2026-13379 - Windows interactive service DNS SearchList state pollution

The DNS SearchList undo logic in the Windows interactive service in OpenVPN 2.x allows a malicious or compromised VPN server to cause persistent global DNS search list corruption or a denial of service (service crash) via a pushed search domain that is identical to or identical to an substring of a previously set search domain.

Affects versions 2.7_alpha1 through 2.7.4. This is fixed in version 2.7.5.