# CVE-2026-88964 - Unsigned underflow and OOB access on malicious PUSH_UPDATE from server 

An integer underflow in OpenVPN on Windows and Android allows remote authenticated servers to cause a denial of service or memory disclosure via crafted domain search options.

OpenVPN versions 2.7_alpha3 through 2.7.7 are affected. This is fixed in version 2.7.8.

CVE Record: [CVE-2026-88964](https://www.cve.org/CVERecord?id=CVE-2026-88964)

Github:
* [OpenVPN/openvpn-private-issues#178](https://github.com/OpenVPN/openvpn-private-issues/issues/178)

Release notes:
* [openvpn-2.7.8](https://community.openvpn.net/ReleaseHistory#openvpn-278-released-7-october-2026)

Reported-By: Cole Munz