PT-2026-41760

CVE-2026-32323

Published

2026-05-19

Updated

2026-07-11

Description by

CVSS 3.1

7.8

High

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mullvad VPN versions prior to 2026.2-beta1

Description Mullvad VPN on macOS may allow local privilege escalation during installation or upgrade. The installer package executes binaries from '/Applications/Mullvad VPN.app' without verifying if the bundle is attacker-controlled or if the path is the legitimate application. A user in the admin group can pre-place a crafted application bundle at that location to achieve code execution as root.

Recommendations Update to version 2026.2-beta1.

Exploitability

Exploit

Fix

Impacts

Researchers

Swayzgl1Tzyyy

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

CWE-345: Insufficient Verification of Data Authenticity