Executive brief
OpenVPN is a widely used software for creating secure private network connections. A vulnerability in how it handles authentication with certain proxy servers could allow a malicious proxy to crash the OpenVPN application. This could lead to a denial of service, preventing users from connecting to their corporate networks or secure resources.
Technical details
An off-by-one error (CWE-193) leading to a stack-based buffer overflow (CWE-121) exists in OpenVPN's NTLM proxy authentication component. The vulnerability is triggered when the OpenVPN client receives a specially crafted NTLM response from a malicious or compromised proxy server. While the primary impact is a denial of service (application crash), the underlying root cause is an out-of-bounds write. Exploitation requires the client to be configured to use NTLM authentication through a proxy. The issue has been addressed in OpenVPN versions 2.6.21 and 2.7.5.
Affected products
- OpenVPN OpenVPN 2.1.0 through 2.6.20, 2.7_alpha1 through 2.7.4
Timeline
- 2026-07-01: patched: Versions 2.6.21 and 2.7.5 released to address the issue.
- 2026-07-30: disclosed: CVE-2026-11771 published.