CVE-2023-7224 lets a local user run code inside OpenVPN Connect on macOS through the DYLD_INSERT_LIBRARIES environment variable. It affects versions 3.0 through 3.4.6 and scores 7.8 (High). OpenVPN's release notes say 3.4.7 fixed it, so update to that or later.
What's affected
Affected: OpenVPN Connect for macOS, versions 3.0 through 3.4.6, per the record. Fixed: 3.4.7 (build 4745), released 21 December 2023, according to the vendor's macOS release notes, which describe it as a fix for a local code injection issue.
The weaknesses are CWE-95 (eval injection) and CWE-94 (code injection). The vector is local with low privileges and no user interaction, and the impact on confidentiality, integrity and availability is high. KEV is false and the sources I read do not say it was exploited in the wild.
The same release notes list a separate fix in 3.4.8, for an issue named CVE-2023-7245 involving ELECTRON_RUN_AS_NODE. That is a different CVE, but if you are updating, go straight to the latest release and skip both.
How to check if you're exposed
Check the installed version on each Mac. In the default install location, this works:
mdls -name kMDItemVersion "/Applications/OpenVPN Connect/OpenVPN Connect.app"
You can also open OpenVPN Connect and read the version in its About screen. Anything from 3.0 through 3.4.6 is affected. If your fleet is managed with an MDM tool, query installed app versions there instead of checking by hand.
What to do now
- Update OpenVPN Connect on macOS to 3.4.7 or later. The latest release is better, because it also carries later fixes.
- Use your MDM or software inventory to find Macs still on 3.4.6 or earlier.
- Limit local accounts on shared Macs. This bug needs local access, so it matters most where several people or services log in.
- Check that users are not running the app with injected libraries or unusual launch environments, and review any security tooling alerts on the app process.
Why it matters
This weakness is about what a program lets its environment change. DYLD_INSERT_LIBRARIES is a macOS setting that makes the loader place an extra library into a program when it starts. Signed apps with the right protections ignore it, but if an app is built in a way that still honors it, a local user can load their own code into the app's process and run it with whatever that process can do.
That matters for a VPN client, because the app holds credentials, profiles and network access. Code running inside it can reach all of that.
The fix is a vendor update. For defenders, the broader step is keeping an accurate inventory of client software so that a local flaw in a VPN app does not sit unpatched for months on laptops nobody checks.
Quick check
Is OpenVPN Connect on Windows or Linux affected?
The record names the macOS version only. Check the vendor's notes for other platforms.
What fixes CVE-2023-7224?
OpenVPN Connect 3.4.7 for macOS, per the vendor's release notes. Use the latest release if you can.
Sources
Last reviewed: 19 October 2026.
