Description
In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.
References (3)
Core 3
Core References
Various Sources
https://news.ycombinator.com/item?id=42390768
Various Sources
https://x41-dsec.de/news/2024/12/11/mullvad/
Scores
CVSS v3
9.0
EPSS
0.0131
EPSS Percentile
67.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-787
Status
published
Published
Dec 12, 2024
Tracked Since
Feb 18, 2026