Based on the description, the vulnerability is an integer underflow in OpenVPN’s handling of domain search options. It allows a remote authenticated server to send crafted configuration data that can lead to an unsigned integer wrap or signed integer overflow. This miscalculation may cause a buffer underflow or expose portions of memory, resulting in a denial of service or memory disclosure to the client.

The affected product is OpenVPN, version 2.7_alpha3 through 2.7.7 on Windows and Android platforms.

Based on the description, an attacker must control an authenticated OpenVPN server to deliver the malicious domain search options, which limits the attack surface. The CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1% suggests that exploitation is rare. The vulnerability is not included in CISA's KEV catalog. No public exploit is known, but a successful trigger could cause service interruption or information disclosure.