Mullvad VPN's macOS installer for versions 2026.1 and earlier fails to verify that the /Applications/Mullvad VPN.app bundle is legitimate before executing binaries from it. This uncontrolled search path element vulnerability (CWE-427) enables a local user in the admin group to pre-place a crafted application bundle at that location, potentially leading to local privilege escalation to root during installation or upgrade. The vulnerability is limited to the installer process and does not affect the running application. The issue is resolved in version 2026.2-beta1.

A local attacker with admin privileges can exploit this vulnerability to execute arbitrary code with root privileges during the installation or upgrade of Mullvad VPN on macOS. This could lead to full system compromise. However, the vulnerability only affects the installer, so existing installations are not vulnerable unless reinstalled or upgraded using the affected installer.

Users should upgrade to Mullvad VPN version 2026.2-beta1 or later to apply the fix. Since the vulnerability only affects the installer, users who do not reinstall or upgrade are not immediately at risk. No additional mitigation is required if not performing installation or upgrade. Patch status is confirmed fixed in version 2026.2-beta1.