Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1020
_____________________________________________________________________

DATE                : 14/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running OpenVPN versions prior to
                                      2.7.8,
                    OpenVPN ovpn-dco-win driver for Windows versions
                                  prior to 1.3.4, 2.8.13,
                 OpenVPN Windows installer versions prior to 2.7.8.

====================================================================
https://community.openvpn.net/Security%20Announcements/CVE-2026-84790
https://community.openvpn.net/Security%20Announcements/CVE-2026-88964
https://community.openvpn.net/Security%20Announcements/CVE-2026-105390
_____________________________________________________________________

CVE-2026-84790 - Remote identity/authentication bypass via embedded
NUL in certificate subject field

OpenVPN allows remote authenticated users to impersonate others via a 
rafted certificate subject field.

OpenVPN version 2.3.0 through 2.7.7 are affected. This is fixed in
version 2.7.8.

CVE Record: CVE-2026-84790

Github:

    OpenVPN/openvpn-private-issues#163

Release notes:

    openvpn-2.7.8

Reported-By: Vivek Parikh

_____________________________________________________________________

CVE-2026-88964 - Unsigned underflow and OOB access on malicious
PUSH_UPDATE from server

An integer underflow in OpenVPN on Windows and Android allows remote
authenticated servers to cause a denial of service or memory
disclosure via crafted domain search options.

OpenVPN versions 2.7_alpha3 through 2.7.7 are affected. This is fixed
in version 2.7.8.

CVE Record: CVE-2026-88964

Github:

    OpenVPN/openvpn-private-issues#178

Release notes:


    openvpn-2.7.8

Reported-By: Cole Munz
_____________________________________________________________________

CVE-2026-105390 - ovpn-dco-win: unprivileged local DoS - device lock
held across socket send deadlocks the host


Improper synchronization in the OpenVPN ovpn-dco-win driver for
Windows allows local attackers to trigger a deadlock via a crafted
write to the ovpn-dco device, causing the host to become unresponsive.

ovpn-dco-win driver for Windows version 0.6.5 through 1.3.3 and 2.4.0
through 2.8.7 are affected. This is fixed in versions 1.3.4 and
2.8.13.

A fixed driver is contained in OpenVPN Windows installer packages for
2.7.8.

CVE Record: CVE-2026-105390

Release notes:

ovpn-dco-win-2.8.13
ovpn-dco-win-1.3.4
Reported-By: Found internally


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================