OpenVPN flaw FAQ: seven questions a change board will ask about 2.7.8

A change board reviews risk, sequence and evidence. The two OpenVPN advisories fixed in 2.7.8 raise predictable questions, and short answers help the discussion stay on the substance.

Question one: is this one vulnerability or two?

Two. CVE-2026-88964 is an integer underflow with an out-of-bounds read, CWE-191 and CWE-125, triggered by crafted domain search options in a PUSH_UPDATE from a server, affecting OpenVPN 2.7_alpha3 through 2.7.7 on Windows and Android.
CVE-2026-84790 is an identity bypass, CWE-290 and CWE-158, triggered by a crafted certificate subject field with an embedded NUL, affecting OpenVPN 2.3.0 through 2.7.7.

Question two: does one release close both?

Yes. The vendor announcement states that 2.7.8 fixes both. Neither advisory documents a workaround, so the release is the remedy.

Question three: is it exploited in the wild?

Neither advisory states exploitation, and no vendor statement in the published notices confirms active use. Treat claims of exploitation as unverified until a reliable source appears.

Question four: is it urgent?

Both carry high scores, 7.1 and 7.6 in CVSS 4.0, and both require an authenticated position. The first needs a hostile or compromised server; the second needs a valid account and a crafted certificate. Urgency is highest where clients connect to servers outside the organization, and where certificate subjects drive authorization.

Question five: can we detect a vulnerable system remotely?

No. The affected products are client binaries and certificate comparison code. ZoomEye reports 2,181,390 assets matching app="OpenVPN" and 1,737,572 for app="OpenVPN" && port="1194". Those are fingerprint matches on internet-facing services and cannot report a build or a client install.

Question six: what evidence closes the change?

Version evidence from the endpoint, per platform. A staging test that presents a crafted certificate subject and observes rejection. A written list of authorization rules that depend on the subject field, with an owner for each.
Crash records reviewed for 2.7 clients during the window. For Android devices, the version string reported by the app rather than the store listing.

Question seven: what stays open afterwards?

Older installations outside management, mobile devices outside managed profiles, and certificates issued under loose validation rules. Each needs an owner and a date.

Two closing facts for the risk register

The fixed release is 2.7.8. Neither advisory documents a workaround. Everything else in the register should be an inventory of your own systems, since the internet-facing counts describe fingerprint populations and not vulnerable installations.