“The most serious vulnerabilities are considered to be race conditions and temporal safety violations leading to memory corruption issues in the signal handler code.”
X41 found six vulnerabilities in a VPN client that ships on five platforms and gets audited regularly. Some let a network-adjacent attacker leak information about who you are. The side channels that come from NAT and modern HTTP stay open because Mullvad doesn’t control them. A heavily audited VPN still had memory corruption in the code that runs when something crashes.