Config review for OpenVPN users: the PUSH_UPDATE path behind CVE-2026-88964

Half of the mitigation work for CVE-2026-88964 happens before the client binary is replaced. The flaw arrives through a configuration message, so the configuration relationship is part of the risk.

The delivery path

An OpenVPN client that connects receives options from the server. PUSH_UPDATE is the message that adds or changes options after the tunnel is established, and domain search options can travel in it. The advisory states that crafted domain search options in that message trigger the underflow on Windows and Android builds from 2.7_alpha3 to 2.7.7.
The client parses the option to configure name resolution. In the vulnerable builds the parse decrements or subtracts on an unsigned value, wraps, and a later read crosses the buffer boundary. The result is a crash or a memory read.

Configuration facts worth collecting

• Which servers can send PUSH_UPDATE to our clients, and are any of them outside our control?
• Which client profiles accept server-pushed DNS settings, and which lock them locally?
• Do any profiles allow redirecting a client to an alternate server after the first connection?
• Are Windows and Android devices receiving profiles from a shared distribution channel? Each answer narrows the population that matches the advisory's precondition: a connecting server that is hostile or compromised.

The distinction between a control and a fix

A profile that ignores pushed DNS options reduces the chance of the crafted option reaching the parser. It does not repair the parser. If the same client later connects to a server that does not respect the profile's local settings, the exposure returns.
That is why the advisory lists no workaround. Local hardening buys time and lowers likelihood, and the fixed release, 2.7.8, remains the only actual remedy.

Detection during the interval

Crashes are the visible event. A client that stops responding during or shortly after a connection to a particular server, and repeats that behaviour after reconnecting, matches the advisory's description.
Log-side signals are thinner. The memory disclosure does not produce a distinctive error, so an operator should not expect a clean detection rule. Compare crash timing against server configuration changes and against the list of servers each endpoint contacts.

After the upgrade

Once clients run 2.7.8, revisit the configuration decisions. Some teams will keep ignoring pushed DNS options because they never wanted server-controlled resolution. That is a policy choice worth recording alongside the version evidence.
For the exposure view, ZoomEye reports 2,181,390 assets matching app="OpenVPN". That counts fingerprint matches on the internet, which is useful for locating your own services and meaningless as a count of vulnerable clients. The client binaries are the thing to inventory here.