# CVE-2026-13379 - Windows interactive service DNS SearchList state pollution

The DNS SearchList undo logic in the Windows interactive service in OpenVPN 2.x allows a malicious or compromised VPN server to cause persistent global DNS search list corruption or a denial of service (service crash) via a pushed search domain that is identical to or identical to an substring of a previously set search domain.

Affects versions 2.7_alpha1 through 2.7.4. This is fixed in version 2.7.5.

CVE Record: [CVE-2026-13379](https://www.cve.org/CVERecord?id=CVE-2026-13379)

Github:
* [OpenVPN/openvpn-private-issues#123](https://github.com/OpenVPN/openvpn-private-issues/issues/123)

Release notes:
* [openvpn-2.7.5](https://community.openvpn.net/ReleaseHistory#openvpn-275-released-1-july-2026)

Reported-By: 章鱼哥 (www.aipyaipy.com)