CVE-2026-13379 is a critical rated flaw (CVSS 9.1) in the OpenVPN Windows interactive service, versions 2.7_alpha1 through 2.7.4. A malicious or compromised VPN server can corrupt the global DNS search list or crash the service. It is fixed in OpenVPN 2.7.5, released 1 July 2026.
What's affected
Per the OpenVPN announcement, the affected range is 2.7_alpha1 through 2.7.4, and the Windows interactive service is the component. The fix is in 2.7.5. The release history shows 2.7.5 came out on 1 July 2026 and that a later 2.7.6 exists, so installing the newest 2.7 release also covers it.
The announcement says OpenVPN 2.x is the family, but only the 2.7 range is listed as affected.
Only the 2.7 branch is listed. The 2.6 branch had releases around the same time according to the release history, but the announcement lists no affected 2.6 versions, so this advisory does not call for action there.
How to check if you're exposed
On a Windows client, check the installed version:
& "C:\Program Files\OpenVPN\bin\openvpn.exe" --version
Also check whether the OpenVPN interactive service is running and whether your clients receive pushed DNS search domains from the server. The attacker model is the VPN server side, so the risk is highest when you connect to servers you do not run.
If you manage a fleet, check the file version of openvpn.exe through your device management tool. Also look at the service list for the OpenVPN interactive service, and note whether it was restarted after the upgrade.
To see the DNS state on a client, look at the adapter DNS settings and the search domain list after a disconnect:
Get-DnsClientGlobalSetting
A search list that grows or holds domains you do not recognize after you disconnect is worth a closer look.
What to do now
- Inventory Windows machines running OpenVPN 2.7.x and note the exact version.
- Upgrade to 2.7.5 or later from the OpenVPN community download page.
- After the upgrade, restart the interactive service and confirm the DNS search list looks normal.
- Use only VPN servers you trust, and review who can change server push options.
- If a client already shows odd search domains after disconnecting, reset the adapter DNS settings.
- Keep a list of the VPN servers your clients use and who administers each.
Why it matters
The announcement describes the bug as search domain undo logic going wrong. When the service tears down state on disconnect, a pushed search domain that equals or is a substring of an earlier one confuses the cleanup. That can leave the global search list corrupted, or crash the service. The record also lists an out-of-bounds read.
The attacker must control the server the client connects to, which is why the trust boundary matters more than the score. The record does not flag this CVE as known exploited.
DNS search lists steer short names to suffixes, so a polluted list can send lookups for short host names to a domain the attacker prefers. The record only claims persistent state pollution or a crash, and we stay with that.
The record lists these weakness classes: CWE-125 (Out-of-bounds Read), CWE-142.
Quick check
Does this affect Linux or macOS clients?
The advisory names the Windows interactive service. It does not list other platforms for this issue.
What does fixed mean here?
The announcement says the problem is fixed in version 2.7.5. Any later 2.7 release also includes that fix.
Who can trigger this?
The announcement says a malicious or compromised VPN server. A client that connects to a server you trust and run has a smaller exposure.
Sources
Last reviewed: 19 October 2026.
