Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-32323

Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer

High7.3EPSS 0.11%
Published
Updated
Reserved
Assigned by
GitHub_M

Description

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.

Timeline

  1. ID reserved

    By GitHub_M

  2. · 2 months later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-32323, by who scored it
Scored byCVSSScoreVector
GitHub_MCNA (assigner)3.1High7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVDNVD · Analyzed3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
0.11% · top 99% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

Affected products

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-32323 badge
[![CVE-2026-32323](https://trackcve.app/badge/CVE-2026-32323.svg)](https://trackcve.app/cve/CVE-2026-32323)

Record last updated .