CVE-2026-82312: OpenVPN Windows NULL DACL DoS Vulnerability

CVE-2026-82312 Overview

CVE-2026-82312 is a local denial-of-service vulnerability in OpenVPN on Windows. The flaw affects OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6. Local authenticated users can disrupt the OpenVPN service by abusing a NULL Discretionary Access Control List (DACL) applied to named interprocess communication (IPC) objects. The weakness is categorized as [CWE-412] Unrestricted Externally Accessible Lock.

Critical Impact
An authenticated local user on a Windows host running OpenVPN can trigger a denial of service against the OpenVPN service by interacting with improperly protected named IPC objects.

Affected Products

OpenVPN 2.0.0 through 2.6.22 on Windows
OpenVPN 2.7_alpha1 through 2.7.6 on Windows
Windows endpoints and servers running any affected OpenVPN build

Discovery Timeline

2026-09-07 - CVE-2026-82312 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82312

Vulnerability Analysis

OpenVPN on Windows creates named IPC objects used for coordination between its service and client components. The affected releases assign a NULL DACL to these named objects. A NULL DACL grants unrestricted access to any authenticated principal on the system. Any local user can therefore open, hold, or manipulate the objects that OpenVPN relies on for internal synchronization.

Because the objects act as externally accessible locks, an attacker can acquire or interfere with them and prevent OpenVPN from performing normal operations. The result is a denial of service against the OpenVPN service on the host. The issue does not expose confidential data and does not allow modification of VPN traffic. Exploitation requires local authenticated access and some user interaction with the vulnerable component.

Root Cause

The root cause is the assignment of a NULL DACL to named IPC objects created by OpenVPN on Windows. NULL DACLs remove access control entirely, so the kernel permits any authenticated caller to open or lock these resources. The correct pattern is to apply an explicit DACL that limits access to the OpenVPN service account and required administrative principals. [CWE-412] describes this class of unrestricted externally accessible lock condition.

Attack Vector

Exploitation requires local authenticated access to a Windows host running an affected OpenVPN build. The attacker enumerates named IPC objects owned by OpenVPN, opens them using the permissive DACL, and holds or manipulates them to block legitimate service operations. No network access, elevated privileges, or credential theft is required. The impact is limited to availability of the OpenVPN service on the local system. See the OpenVPN Security Announcement CVE-2026-82312 for vendor technical details.

Detection Methods for CVE-2026-82312

Indicators of Compromise

Unexpected termination, hangs, or repeated restarts of the openvpn.exe or OpenVPN service process on Windows hosts.
Local, non-administrative processes opening handles to OpenVPN named IPC objects such as named pipes or mutexes.
Event log entries indicating failure of OpenVPN to acquire its own IPC resources during startup or reconnect.

Detection Strategies

Inventory Windows endpoints and identify OpenVPN builds within the vulnerable ranges 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6.
Audit handle activity to OpenVPN named pipes and synchronization objects, flagging access by non-service accounts.
Correlate OpenVPN service crashes or restart loops with concurrent local user process activity.

Monitoring Recommendations

Forward Windows Service Control Manager and application event logs for OpenVPN to a central log platform for alerting.
Track process creation and handle-open events on Windows endpoints running OpenVPN using Sysmon or equivalent telemetry.
Alert on repeated OpenVPN service failures on the same host within short time windows.

How to Mitigate CVE-2026-82312

Immediate Actions Required

Identify all Windows systems running OpenVPN versions in the affected ranges and prioritize them for patching.
Restrict interactive and remote local logon rights on hosts running OpenVPN to trusted administrators only.
Monitor for anomalous local process interaction with OpenVPN IPC objects while patch rollout is in progress.

Patch Information

Upgrade to a fixed OpenVPN release as published by the vendor. Refer to the OpenVPN Security Announcement CVE-2026-82312 for the specific fixed version numbers and download locations. Apply the update to every Windows endpoint and server that hosts an affected build.

Workarounds

Limit the set of local users who can authenticate to hosts running OpenVPN on Windows to reduce exposure.
Where OpenVPN client functionality is not required, stop and disable the OpenVPN service until the patched version is installed.
Use application allowlisting to block untrusted binaries from executing on hosts that provide VPN connectivity.

bash

# Query installed OpenVPN version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\OpenVPN" | Select-Object -Property Version

# Stop and disable OpenVPN service as a temporary workaround
Stop-Service -Name OpenVPNService
Set-Service -Name OpenVPNService -StartupType Disabled