CVE-2026-63649

The vulnerability in OpenVPN affects the Windows interactive service, allowing local authenticated users to circumvent the trusted configuration directory constraint and load arbitrary configuration files through specially crafted options that bypass whitelist checks. This could lead to unauthorized access or manipulation of the VPN configuration, potentially compromising the security of the VPN connection. Organizations using affected versions of OpenVPN should prioritize patching this vulnerability to mitigate risks associated with local user exploitation.