Scary what the implications of this will be for OpenVPN traffic that has been captured and stored over the past 2 years.
Exploiting this requires a client that sends a malicious Heartbeat packet with a large payload size.
This is unlikely to have happened in the past without any malice.