CVE-2026-84471 in Canonical and OpenVPN Products
Published on October 14, 2026

The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-84471 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

NONE

Weakness Type

What is a Dangling pointer Vulnerability?

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

CVE-2026-84471 has been classified to as a Dangling pointer vulnerability or weakness.

Products Associated with CVE-2026-84471

stack.watch emails you whenever new vulnerabilities are published in Canonical Ubuntu Linux or OpenVPN. Just hit a watch button to start following.

Canonical Ubuntu Linux

OpenVPN

Affected Versions

OpenVPN: