mullvad/mullvadvpn-app 2025.7

on GitHub

This release is for desktop only.

Here is a list of all changes since last stable release 2025.6:

Added

• Add notification that shows when the user is connected to WireGuard with a port that is not
  supported.

Linux

• The deb package repositores now have static codenames on top of the existing distro version
  specific codenames. The stable repository always have the "stable" codename,
  and the beta repository has the "beta" codename.

Changed

• Replace Classic McEliece with HQC as one of the post-quantum safe key exchange
  mechanisms used for the quantum-resistant tunnels. The main benefits here are that HQC
  uses a lot less CPU to compute the keypair, and the public key sent to the server
  is drastically smaller.

Fixed

• Automatically connect when IP version becomes available.

Linux

• Fix syntax error in Apparmor profile.
• Fix issue where settings were lost after an upgrade if mullvad-daemon was not restarted
  before mullvad-early-boot-blocking.service. That is, before a reboot.

Windows

• Fix issue where daemon got stuck trying to connect only over IPv4 (or only IPv6).

macOS

• Fully uninstall the app when it is removed by being dropped in the bin.

Security

macOS

• Fix potential local privilege escalation when app was incorrectly removed by being dropped
  in the bin but still leaving behind a launch daemon. This fixes CVE-2025-46351 reported by
  Egor Filatov (Positive Technologies).