PT-2026-41760 · Mullvad · Mullvad Vpn

Swayzgl1Tzyyy · Published 2026-05-19 · Updated 2026-07-11 · CVE-2026-32323

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mullvad VPN versions prior to 2026.2-beta1

Description Mullvad VPN on macOS may allow local privilege escalation during installation or upgrade. The installer package executes binaries from '/Applications/Mullvad VPN.app' without verifying if the bundle is attacker-controlled or if the path is the legitimate application. A user in the admin group can pre-place a crafted application bundle at that location to achieve code execution as root.

Recommendations Update to version 2026.2-beta1.

Exploit

Fix

LPE

Insufficient Verification of Data Authenticity

Uncontrolled Search Path Element

Improper Privilege Management

Weakness Enumeration

CWE-345

CWE-427

CWE-269

Related Identifiers

CVE-2026-32323

GHSA-C2G6-W5FQ-VW3M

Affected Products

Mullvad Vpn

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32323.json · Exploit
• https://github.com/mullvad/mullvadvpn-app/commit/032fdcb927c0b6d3e5e1aba4140d33adf22a6bfb · Patch
• https://github.com/mullvad/mullvadvpn-app/security/advisories/GHSA-c2g6-w5fq-vw3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32323 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32323 · Vendor Advisory
• https://t.me/cveNotify/164481 · Telegram Post
• https://twitter.com/CVEnew/status/2056670113974341990 · Twitter Post
• https://twitter.com/L4UR3N7/status/2075904331895734721 · Twitter Post
• https://t.me/cveNotify/163955 · Telegram Post
• https://t.me/CVEtracker/54182 · Telegram Post