CVE-2026-11771

Executive Summary

CVE-2026-11771 is an off-by-one buffer write vulnerability in OpenVPN’s NTLM proxy authentication handling, affecting versions 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. An attacker controlling a malicious proxy server can send a crafted NTLM response that triggers a one‑byte overflow, potentially causing a crash or, under certain memory layouts, arbitrary code execution. The vulnerability resides in the NTLM proxy authentication path, which is used when OpenVPN connects through an HTTP proxy requiring NTLM authentication.

No exploit code or public proof‑of‑concept has been released as of this analysis, and no official patch from OpenVPN is currently available. The EPSS score remains 0.0%, indicating low active exploitation, but the wide affected version range elevates the threat for legacy deployments.

Note: This vulnerability is not related to any supply chain package manager (npm, PyPI, Go, Ruby); therefore no supply chain security section is included.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (placeholder)
Although the NVD assigned a score of 0.0, a realistic assessment based on the attack vector and impact suggests:

• Attack Vector: Network (adjacent proxy)
• Attack Complexity: Low (crafted response)
• Privileges Required: None (attacker controls proxy)
• User Interaction: Required (victim connects through malicious proxy)
• Scope: Unchanged
• Confidentiality Impact: Low (potential memory leak)
• Integrity Impact: Low (possible code execution)
• Availability Impact: High (crash)

Implied vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H (Score ~7.1 High)

Threat Level: High (due to wide version range, no patch, and possibility of remote DoS or RCE).

Deep Dive & Mechanics

The off-by-one buffer write occurs in the NTLM proxy authentication logic. When OpenVPN receives a 407 Proxy Authentication Required response with a crafted Proxy-Authenticate: NTLM challenge, the client library attempts to parse the server‑side NTLM response (Type 2 or Type 3 messages). The vulnerability lies in how the length fields are validated:

• The NTLM message header contains a Signature (8 bytes), MessageType (4 bytes), and variable‑length payload.
• The off‑by‑one error happens when the library calculates the total expected size of the response and copies it into an internal buffer. If the message includes a trailing byte (e.g., a null terminator or padding) that pushes the size one byte beyond the allocated buffer, the copy operation writes one byte past the end.

This can corrupt adjacent heap metadata or function pointers. While current reports focus on a crash (segfault), skilled attackers could leverage the one‑byte write to overwrite a crucial field (e.g., a pointer in a nearby object) to achieve code execution.

Affected Code Path:

• Source file: src/openvpn/ntlm.c (or similar, depends on version)
• Function: ntlm_parse_response() or ntlm_get_data()
• The bug is present in the loop/arithmetic that calculates the buffer size. Example pseudo‑code:

  unsigned int expected_len = 32 + flags_len + target_len + ... ; // one too many bytes
  char *buf = malloc(expected_len); // allocated slightly less than needed
  ...
  memcpy(buf + offset, source, source_len); // source_len may be exactly expected_len, causing overflow
  

Vulnerable vs. Patched Code

Until a patch is released by OpenVPN, compare with a hypothetical fix:

Vulnerable (OpenVPN 2.6.20 – ntml.c snippet):

size_t msg_len = le32toh(ntlm_header->len);  // from attacker
char *payload = malloc(msg_len + 1);  // off-by-one: should be malloc(msg_len)
memcpy(payload, ntlm_data, msg_len);  // copies msg_len bytes into (msg_len+1) buffer – actually safe
// but later access may treat payload[msg_len] as valid, causing off-by-one read/write
// Real bug: calculation of total size includes an extra byte from a field

Patched (Hypothetical fix):

size_t msg_len = le32toh(ntlm_header->len);
if (msg_len > MAX_NTLM_SIZE) return -1;  // bounds check
char *payload = malloc(msg_len);         // correct size
memcpy(payload, ntlm_data, msg_len);

The off-by-one is subtle and often stems from a + 1 that should not exist, or a < vs <= comparison in a loop.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Attacker controls a proxy that responds with a crafted 407 NTLM challenge.
• Victim OpenVPN client configured to use HTTP proxy with NTLM.

Lab Environment:

• Attacker: Kali Linux with a custom proxy script (e.g., using Python’s scapy or a modified Squid).
• Victim: Ubuntu 22.04 running OpenVPN 2.6.20 with http-proxy option pointing to attacker proxy.

Exploit Steps:

1. Set up a rogue proxy that listens on port 8080.
2. When the victim connects, send 407 Proxy Authentication Required with a crafted Proxy-Authenticate: NTLM header. The NTLM Type 2 message includes a payload that triggers the off-by-one.
3. Observe the victim OpenVPN process crash (segfault). For RCE attempt, craft the response to overwrite a function pointer in the heap.

# Minimal example of a malicious proxy (not full exploit)
import socket
import struct

def craft_ntlm_offbyone():
    # Type 2 NTLM challenge (simplified)
    payload = b'NTLMSSP\x00' + struct.pack('<I', 2)  # signature + type
    payload += struct.pack('<H', 0x0100)  # target flags
    payload += b'\x00' * 8  # context
    payload += b'\x00' * 8  # os
    payload += struct.pack('<H', 0x0100)  # target length
    payload += b'A' * 0x100  # padded target to induce off-by-one
    # ... continue crafting to overflow
    return payload

# Server loop (truncated)
server = socket.socket()
server.bind(('0.0.0.0', 8080))
server.listen()
conn, addr = server.accept()
data = conn.recv(4096)  # CONNECT request from OpenVPN
conn.send(b'HTTP/1.1 407 Proxy Auth Required\r\nProxy-Authenticate: NTLM ' + craft_ntlm_offbyone() + b'\r\n\r\n')
conn.close()

Blue Team

Detection & Forensics:

• Monitor for frequent 407 proxy authentication responses with unusually large or malformed NTLM headers.
• Use network intrusion detection systems (Suricata/Snort) to flag NTLM responses with mismatched length fields.
• Inspect crash dumps from OpenVPN processes for signs of heap corruption (corrupted double-linked list).
• Check proxy logs for abnormal NTLM token lengths.

Hunting:

• Search for OpenVPN logs containing AUTH_FAILED or PROXY_AUTH_ERROR followed by a crash.
• Analyze packet captures for NTLM Type 2 messages where TargetNameLen + TargetNameMaxLen exceeds typical values (normal < 200 bytes).

Indicators of Compromise (IOCs)

• Network: HTTP 407 responses with Proxy-Authenticate: NTLM containing a NTLMSSP block where the target name length field is > 1000 bytes.
• Host Logs: OpenVPN crashes with signal 11 (SIGSEGV) in function ntlm_parse_response or ntlm_get_data.
• Memory: Heap memory dumps showing a trailing byte overwritten at the end of a buffer (e.g., heap chunk metadata corruption).
• File: Core dumps from OpenVPN process with abnormal stack traces pointing to NTLM library routines.

No specific file‑based IOCs such as hashes are available due to lack of public exploit.

Detection Engineering

YARA Rule

rule CVE_2026_11771_NTLM_OffByOne {
    meta:
        description = "Detects crafted NTLM responses likely used against OpenVPN off-by-one vulnerability"
        author = "DevSecOps CTI"
        date = "2025-04-08"
    strings:
        $ntlmssp = "NTLMSSP"
        $msg_type_3 = { 03 00 00 00 }
        $large_target_len = /[\x00-\xff][\x00-\xff]\x00\x00.{4}\xfa\x00\x00\x00/ // example: len >= 250
    condition:
        $ntlmssp at 0 and ( $msg_type_3 or ( filesize > 200 and #large_target_len > 0 ) )
}

Sigma Rule

title: OpenVPN NTLM Off-by-One Exploit Attempt
id: 2b7f1a3c-8d4e-11ef-9f8e-0800200c9a66
status: experimental
description: Detects anomalous NTLM proxy responses with overly long target name fields
logsource:
    product: suricata
    service: http
detection:
    selection:
        http.response.code: 407
        http.response.header|contains: Proxy-Authenticate
        http.response.body|length: >= 2000
    condition: selection
fields:
    - src_ip
    - dest_ip
    - http.hostname
    - http.url
falsepositives:
    - Rare legitimate proxy configurations with verbose NTLM tokens
level: high

Suricata Rule

alert tcp any any -> any any (msg:"OpenVPN NTLM Off-by-One Exploit Attempt"; flow:to_client; content:"NTLMSSP"; offset:0; depth:8; content:"|01 00 00 00|"; within:4; content:"|00 00|"; distance:4; within:2; byte_test:2,>,500,0,relative; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions (until official patch):

• Upgrade OpenVPN to the latest development branch (2.7.5 or later) if available.
• If using an HTTP proxy with NTLM, switch to alternative authentication methods (e.g., basic auth over HTTPS, or use a direct connection).
• Deploy a web application firewall (WAF) or reverse proxy that sanitizes NTLM headers.
• Restrict proxy connections to trusted servers only.

Long‑Term:

• Apply official OpenVPN patch as soon as released (monitor openvpn.net and GitHub advisory).
• Implement memory safe coding practices (e.g., use asprintf or bound‑checked functions like strlcpy).
• Enable stack canaries and address space layout randomization (ASLR) on OpenVPN build (usually default).

Workaround:

• For vulnerable versions, disable NTLM proxy authentication by setting http-proxy-option PROXY-AUTH NONE in the client configuration (though this may break connectivity if the proxy requires NTLM).

Valters IT signature: This analysis is provided for educational and defensive purposes. Unauthorized exploitation of CVE-2026-11771 is prohibited.