OpenVPN 2.7.8 release notes for defenders: what changed and what to re-test

Release notes are worth reading as a test plan. For OpenVPN 2.7.8 the relevant entries are two security fixes, and the tests that follow from them are behavioural rather than procedural.

What the release contains

Two CVE identifiers are fixed in 2.7.8. CVE-2026-88964 concerns an unsigned underflow and out-of-bounds access when a server sends a malicious PUSH_UPDATE, and the vendor scopes it to Windows and Android clients from 2.7_alpha3 through 2.7.7. CVE-2026-84790 concerns an identity and authentication bypass through an embedded NUL in the certificate subject field, scoped to 2.3.0 through 2.7.7.
Both advisories credit individual reporters and link a private issue in the OpenVPN repository, but neither publishes a proof of concept. The fixed behaviour is described in general terms: no crash on the crafted push, no impersonation from the crafted subject.

Test one: the client parser

Set up a staging server that sends a domain search option with a malformed length. Connect a 2.7.7 client first and record the crash or the abnormal termination. Then connect a 2.7.8 client and confirm operation continues.
Run the test on Windows and Android, since those are the scoped platforms. A Linux client result is useful for comparison and is not what the advisory states.

Test two: the certificate path

Issue a certificate whose subject common name contains an embedded null byte, then attempt authentication against a 2.7.7 server using a policy that should reject the identity. Record the result, then repeat against 2.7.8.
The expected change is a rejection. If the crafted certificate still authenticates at 2.7.8, the deployment may be running a mixed binary set, and the version audit needs repeating.

Tests three and four: regressions

Configuration pushes that rely on domain search options should be exercised with a valid payload. The parser changed, and normal behaviour should be unchanged.
Certificate-based authorization rules should be tested with legitimate certificates. The identity comparison changed, and the ordinary mapping between a subject and a user should still hold.

Values to record

Endpoint versions by platform. The two test outcomes with timestamps. The count of issued certificates reviewed for malformed subject attributes. The count of authorization rules that depend on the subject field.
Internet fingerprint counts belong in a separate section, labelled as context. ZoomEye reports 2,181,390 assets matching app="OpenVPN" and 1,737,572 for app="OpenVPN" && port="1194". They are fingerprint matches, not vulnerable hosts, and they do not measure a client installation.

What does not need re-testing

The advisories describe no configuration format change and no protocol change beyond the malformed input handling. Nothing requires a profile redesign, and neither notice documents a workaround. The release is a binary update with two behavioural fixes, and the tests above are the evidence that both took effect.