CVE-2026-88964 in OpenVPN: the PUSH_UPDATE path explained

CVE-2026-88964 affects OpenVPN 2.7_alpha3–2.7.7 on Windows and Android: crafted domain search options in a PUSH_UPDATE message cause an unsigned integer underflow, a buffer over-read and a client crash. The flaw is fixed only in 2.7.8, and the advisory lists no workaround.

• Vulnerable builds: OpenVPN 2.7_alpha3 through 2.7.7 on Windows and Android
• Trigger is crafted domain search options in PUSH_UPDATE
• Only 2.7.8 fixes the parser; no workaround in the advisory
• ZoomEye reports 2,181,390 assets matching app="OpenVPN"