OpenVPN 2.7.9 ships with Windows-focused security fixes
The OpenVPN community project's latest release hardens the interactive service and command-line parsing, with two new CVEs traced back to security researcher Heiko Hund.
OpenVPN's community project pushed version 2.7.9 out on November 5, 2026. It is officially a bugfix release, but it also fixes several security issues, and the fixes are almost all aimed at the Windows build.
"OpenVPN is proud to release OpenVPN 2.7.9," Frank Lichtenheld wrote, putting it out on behalf of the community team. "This is a bugfix release fixing several security issues." The statement is terse, but it lands the classification.
The two new CVEs both come from security researcher Heiko Hund. They target the Windows interactive service, known as openvpnserv, and the way OpenVPN parses command lines and loads plugins. Here is what actually changed.
The security fixes, spelled out
Every security fix in 2.7.9 targets Windows and centers on the service's execution model. Plugins can now load their dependency DLLs only from trusted directories: the plugin folder, the application folder, and the system folder. That closes a path attackers have used to slip in a malicious DLL.
When openvpn.exe launches from the interactive service, it now runs at a high integrity level. That puts a bigger barrier in front of a local attacker trying to tamper with a running OpenVPN process.
The two CVEs follow. CVE-2026-121720 is about environment-variable filtering in openvpnserv, tracked privately as issue #186. CVE-2026-115342 covers command-line quoting: the service now validates the command line more carefully, and openvpn.exe parses its own command line with the same function the service uses, ending a divergence the two programs had shared.
Keep in mind that detailed public advisory pages for both CVEs were not yet live when 2.7.9 shipped. Both were disclosed privately through the project's GitHub issues, so full technical detail was still missing at release time.
Beyond the security fixes
There is also a handful of user-facing changes. On Linux, OpenVPN sets IFF_BACKPRESSURE on the tun/tap interface when it can. That lets the kernel prioritize incoming traffic when the userspace side lags instead of simply dropping everything.
Windows GUI users get a quieter login. When a config sets a username but leaves the password blank, OpenVPN now sends a hint so the management interface can pre-fill the username. It only fires when the management client supports it, meaning a compatibility level of 6 or higher.
The bundled Windows GUI jumped to 11.67, which also fixes tray tooltip positioning on secondary monitors, and improves the Swedish translation.
Then there is the background code-quality work. The project keeps pushing toward OpenSSL 4.1 readiness, and someone swept the codebase replacing unsafe strncpy() calls with safer alternatives. Key material now gets wiped with secure_memzero() after use. On top of that.
Age does not seem to slow the bug hunting. OpenVPN is roughly 25 years old now, having debuted in May 2001, which makes it older than much of the modern internet and far older than something like WireGuard. 2026 alone has been unusually busy for the project's CVE list, and almost everything points back to Windows: interactive-service flaws, ovpn-dco-win driver problems, certificate-handling bugs. 2.7.9 sits right in that same hardening effort around the Windows service.
It rides on the 2.7 series, which shipped in February 2026 with some larger architectural changes: multi-socket servers, Linux DCO kernel-module support, and TLS 1.3. The older 2.6 line moved into "Old Stable Support" after 2.6.22, so organizations still on 2.6.x may want to look upward, though DCO does need a modern Linux kernel to run.
One thing worth separating from this story. OpenVPN's commercial Access Server has its own separate CVEs, including a PHP2Shell remote code execution. That is a different product entirely and not part of this community release, so keep the two apart.
OpenVPN 2.7.9 is available now in 64-bit, 32-bit, and ARM64 Windows MSI form, plus a signed source tarball. Windows users running the service or GUI should update.
Head here to the GitHub release page.
