CVE-2026-32323

HIGH 7.3

Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.

CWE	CWE-427 CWE-345 CWE-269
Vendor	mullvad
Product	mullvadvpn-app
Published	May 19, 2026
Last Updated	May 20, 2026

Stay Ahead of the Next One

Get instant alerts for mullvad mullvadvpn-app

Be the first to know when new high vulnerabilities affecting mullvad mullvadvpn-app are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

mullvad / mullvadvpn-app

< 2026.2-beta1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mullvad/mullvadvpn-app/security/advisories/GHSA-c2g6-w5fq-vw3m github.com: https://github.com/mullvad/mullvadvpn-app/commit/032fdcb927c0b6d3e5e1aba4140d33adf22a6bfb