CVE-2025-5687

Description

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).

Reserved 2025-06-04 | Published 2025-06-11 | Updated 2025-06-11 | Assigner mozilla

Problem types

Local privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below.

Product status

Any version before (macOS)
affected

Credits

Egor Filatov (Positive Technologies)

References

bugzilla.mozilla.org/show_bug.cgi?id=1953736

www.mozilla.org/security/advisories/mfsa2025-48/

cve.org (CVE-2025-5687)

nvd.nist.gov (CVE-2025-5687)

Download JSON