Two fixes, two audiences: explaining the OpenVPN advisories to management and to engineers

The same release, OpenVPN 2.7.8, closes two flaws with different audiences. A short briefing for each keeps the change from being read as either routine or catastrophic.

For management

Two high-severity vulnerabilities were published for OpenVPN and fixed in 2.7.8. The first, CVE-2026-88964, can crash a VPN client on Windows or Android or leak a small amount of memory when it connects to a malicious server. It affects a narrow band of versions, 2.7_alpha3 through 2.7.7.
The second, CVE-2026-84790, lets someone with a valid VPN account impersonate another user by presenting a crafted certificate. It affects versions from 2.3.0 through 2.7.7, which is a much wider band.
Both require the attacker to hold a legitimate position first: a server for the first flaw, an account for the second. Neither advisory reports exploitation in the wild, and neither documents a workaround.
The recommended action is a client and server upgrade to 2.7.8 plus a review of how certificates are issued. The work is bounded, the fixed version is available, and no configuration redesign is required by the advisories.

For engineers

The client flaw is an unsigned integer underflow with an out-of-bounds read, classified CWE-191 and CWE-125, in the handling of domain search options inside a PUSH_UPDATE. The attacker is a server; the victim is a 2.7 client on Windows and Android. CVSS 4.0 base is 7.1 with no attack requirements.
The identity flaw is CWE-290 with CWE-158, an authentication bypass that uses an embedded NUL in the certificate subject. The attacker is an authenticated user; the victim is any server or client that compares subject fields. The affected range starts at 2.3.0. CVSS 4.0 base is 7.6 with attack requirements present.
Testing should cover two behaviours: a client receiving a crafted domain search option must not crash, and a server receiving a crafted subject field must reject the certificate. Version evidence alone does not demonstrate either.

The number both audiences should see with a caveat

ZoomEye reports 2,181,390 assets matching app="OpenVPN". That figure is a fingerprint population. It is not the number of vulnerable installations, it does not include desktop clients, and it cannot distinguish builds. Present it as an argument for inventory ownership, not as a risk score.

Closing message

Both flaws close with 2.7.8. The client portion is a binary replacement with a short deadline for Windows and Android endpoints. The identity portion is a binary replacement plus a certificate review that takes longer than the deployment. Schedule them together and report them separately.