Blame
| 348678 | flichtenheld | 2026-11-12 12:21:40 | 1 | # CVE-2026-115342 - Windows: Interactive service option validation bypass via command-line parsing mismatch |
| 2 | ||||
| 3 | The Windows interactive service validates the options passed to it using `CommandLineToArgvW()`, while openvpn.exe relies on the C runtime to split its command line. Since Visual Studio 2008 the two parsers disagree on the handling of two consecutive double quotes inside a quoted string, so a crafted command line can hide restricted options from the interactive service validator while openvpn.exe still executes them. This bypasses the requirement that configuration files are only loaded from the locked-down OpenVPN configuration directory. |
|||
| 4 | ||||
| 5 | OpenVPN versions 2.4.0 through 2.7.8 are affected. This is fixed in version 2.7.9. |
|||
| 6 | ||||
| 7 | CVE Record: [CVE-2026-115342](https://www.cve.org/CVERecord?id=CVE-2026-115342) |
|||
| 8 | ||||
| 9 | Github: |
|||
| 10 | * [OpenVPN/openvpn-private-issues#184](https://github.com/OpenVPN/openvpn-private-issues/pull/184) |
|||
| 11 | ||||
| 12 | Release notes: |
|||
| 13 | * [openvpn-2.7.9](https://community.openvpn.net/ReleaseHistory#openvpn-279-released-5-november-2026) |
|||
| 14 | ||||
| 15 | Reported-By: Heiko Hund |