CVE-2025-5687

HIGH 7.8CVE-2025-5687 · Published 11/06/2025 · updated 17/06/2026

In short

CVE-2025-5687 is a HIGH (CVSS 7.8) vulnerability affecting vpn (mozilla).
Chance of exploitation in the next 30 days (EPSS): 0.13%, higher than 2.4% of all vulnerabilities.
Fix: update to 2.28.0 or later.

Package	Affected versions	Patched versions
vpn mozilla	`< 2.28.0`	`2.28.0`

Description

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.*. This vulnerability was fixed in Mozilla VPN 2.28.0 (macOS).

References

bugzilla.mozilla.org/show_bug.cgi · Permissions Required
mozilla.org/security/advisories/mfsa2025-48 · Vendor Advisory

More vulnerabilities in vpn

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free