CVE-2026-121720 - Windows: Interactive service passes user environment to openvpn.exe
In OpenVPN on Windows, RunOpenvpn() in the Windows Interactive Service created the child process environment block for openvpn.exe from the full environment of the requesting user. This included variables the user defined in HKCU\Environment.
User-controlled environment variables can influence what code openvpn.exe loads and runs. For example, a user-defined OPENSSL_CONF variable can cause OpenSSL to load provider modules. Because the resulting openvpn.exe process has access to privileged operations through the --msg-channel connection to the service, a local user could run code of their choice inside the OpenVPN process and use that process to request privileged service operations.
The fix changes the service to build the environment for openvpn.exe from system-wide variables, while only copying a small allowlist of user-specific variables from the user's environment: APPDATA, LOCALAPPDATA, TEMP, TMP, USERDOMAIN, USERNAME, and USERPROFILE. Other user-defined variables are no longer passed to openvpn.exe.
OpenVPN versions 2.4.0 through 2.7.8 are affected. This is fixed in version 2.7.9.
CVE Record: CVE-2026-121720
Github:
Release notes:
Reported-By: @refiaa