Mullvad
Monthly
Local privilege escalation in Mullvad VPN for macOS versions 2026.1 and earlier allows a user in the admin group to gain root code execution during installation or upgrade. The installer's preinstall script executes binaries from /Applications/Mullvad VPN.app without verifying the bundle's integrity, enabling an admin-group attacker to pre-stage a malicious app bundle that runs as root. No public exploit identified at time of analysis, and the flaw is only triggerable when an installer is run, not on already-installed systems.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Local privilege escalation in Mullvad VPN for macOS versions 2026.1 and earlier allows a user in the admin group to gain root code execution during installation or upgrade. The installer's preinstall script executes binaries from /Applications/Mullvad VPN.app without verifying the bundle's integrity, enabling an admin-group attacker to pre-stage a malicious app bundle that runs as root. No public exploit identified at time of analysis, and the flaw is only triggerable when an installer is run, not on already-installed systems.
Local availability degradation in Mullvad's wireguard.sys kernel driver 0.10.1 stems from improper reference count management (CWE-911) within the AdapterState function of the IOCTL handler. An attacker with high local privileges can trigger this defect to cause driver instability or crash the WireGuard adapter, impacting VPN connectivity. A public proof-of-concept exploit exists; however, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and carries a CVSS 4.0 score of 4.6, reflecting its constrained impact and access prerequisites.
An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.