# CVE-2026-78221: OpenVPN Windows Interactive Service buffer size miscalculation

Source: https://junglewise.ai/threats/cve-2026-78221-openvpn-windows-interactive-service-buffer-size-miscalculation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78221 · Severity: info · Published 2026-09-07

OpenVPN's Windows Interactive Service contains a buffer size calculation error that can be exploited by authenticated local users. An attacker with local system access could cause memory corruption or leak sensitive information through specially crafted NRPT inputs, potentially compromising system stability or exposing confidential data.

Technologies: [Openvpn](https://junglewise.ai/threats/technologies/openvpn). Vendors: [Openvpn](https://junglewise.ai/threats/vendors/openvpn).

## Quick answers

**Is CVE-2026-78221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78221 being exploited in the wild.

**How severe is CVE-2026-78221?** Informational severity, published 7 September 2026.

**Which products and versions are affected?** Openvpn 2.7_alpha1 through 2.7.6.

**Is there a fix for CVE-2026-78221?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78221 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-78221?** Check whether you run Openvpn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a buffer size calculation error in OpenVPN's Windows Interactive Service component. It affects versions 2.7_alpha1 through 2.7.6 and allows local authenticated users to trigger memory corruption or information disclosure by submitting specially crafted NRPT (Name Resolution Policy Table) inputs. The vulnerability requires local authentication and direct access to the affected service. An attacker can cause memory corruption leading to denial of service or read adjacent memory to disclose sensitive information.

## Affected products

- OpenVPN OpenVPN 2.7_alpha1 through 2.7.6

## Timeline

- 2026-09-07: disclosed

## References

- [https://community.openvpn.net/Security%20Announcements/CVE-2026-78221](https://community.openvpn.net/Security%20Announcements/CVE-2026-78221)

## Related threats

- [OpenVPN use-after-free in TLS session promotion or expiry](https://junglewise.ai/threats/cve-2026-84471-the-fix-for-was-incomplete-a-use-after-free-in-openvpn-2-6-0)
- [OpenVPN integer underflow in domain search options](https://junglewise.ai/threats/cve-2026-88964-an-integer-underflow-in-openvpn-version-2-7-alpha3-through-2-7-7)
- [OpenVPN identity impersonation via embedded NUL in certificate subject](https://junglewise.ai/threats/cve-2026-84790-openvpn-2-7-alpha1-through-2-7-7-allows-remote-authenticated)
- [OpenVPN ACK packet retransmission denial of service](https://junglewise.ai/threats/cve-2026-84732-openvpn-ack-packet-retransmission-denial-of-service)
- [OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows)