Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-19 | 2 | Disclosure2 |
| 2026-07-11 | 1 | Disclosure1 |
CVE-2026-32323 Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during insta… https://www.cve.org/CVERecord?id=CVE-2026-32323
Post summary
The text announces a local privilege escalation vulnerability in Mullvad VPN on macOS (versions 2026.1 and below) but does not provide a PoC, exploit, patch, or evidence of active exploitation.
2026 Android 16: OS bug lets any app leak traffic outside VPN tunnel despite killswitch (affects all providers). 2026 CVE-2026-32323: Local root privilege escalation on macOS via malicious bundle during install/upgrade (fixed later). 2026 exit IP fingerprinting: Deterministic assignment from WireGuard key keeps relative exit IP position similar across servers. Observers can correlate with high confidence that the same user switched servers, enabling activity linking between sessions. Does not reveal real identity but breaks unlinkability and weakens anonymity. Mitigation rollout ongoing. iOS remains vulnerable to TunnelCrack LocalNet traffic leaks. No major breaches; audits positive.
Post summary
The text announces new OS vulnerabilities across Android, macOS, and iOS, outlines their technical details, and notes that fixes and mitigations are being released, while no active exploitation is reported.
CVE-2026-32323 Local Privilege Escalation in Mullvad VPN macOS Versions 2026.1 and Below https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32323
Post summary
A brief announcement of a local privilege escalation vulnerability (CVE-2026-32323) affecting Mullvad VPN on macOS, with a link to further details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | mullvad | mullvad_vpn | - | macos | - |