Critical Mullvad VPN Vulnerabilities Let Attackers Execute Malicious Code
The well-known Mullvad VPN service has a number of high-severity flaws that security researchers have found that might let hackers run malicious code and jeopardize user privacy. The vulnerabilities were found in late 2024 when X41 D-Sec GmbH carried out a thorough security audit.
The most significant problems in Mullvad's signal handler code are related to race circumstances and temporal safety violations, which may cause memory corruption and possibly even code execution. Researchers caution that an attacker who can set off a signal at the proper time might be able to take advantage of these vulnerabilities, even if exploitation is thought to be difficult.
Exploitation is possible if an attacker can set off a signal in the correct situation because the alternate stack collides wit...
