A critical privilege escalation and security validation flaw in the Mullvad VPN client could allow a local attacker to achieve full system compromise.

This vulnerability involves an uncontrolled search path (CWE-427), insufficient verification of data authenticity (CWE-345), and improper privilege management (CWE-269), requiring an authenticated local user to initiate.

A local attacker could exploit these flaws to gain elevated privileges on the host system, potentially leading to total system compromise, data theft, or persistence. With a CVSS score of 7.3, this represents a significant risk for any workstation or server where the VPN client is installed.

Immediate Action: Update the Mullvad VPN client to version 2026.2-beta1 or later immediately to resolve the identified search path and validation issues.

Proactive Monitoring: Monitor system logs for unauthorized attempts to escalate privileges or unexpected modification of application binary paths.

Compensating Controls: Ensure that local user accounts have the principle of least privilege applied and that host-based integrity monitoring is active.

Public Exploit Available: Unknown

Users and administrators should prioritize updating the Mullvad VPN client across all managed endpoints. Failure to patch allows local users to potentially bypass security controls and gain administrative-level access to the underlying operating system.