CVE-2026-45182
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Vulnerability in GrapheneOS before 2026050400. Attackers can discover the real IP address of a VPN user due to a registerQuicConnectionClosePayload optimization, when 'Block connections without VPN' and 'Always-on VPN' settings are enabled. An application can let system_server transmit UDP traffic on its behalf.
Risk Assessment
Risk includes leakage of the user's real IP address, compromising privacy and anonymity, especially in environments requiring location protection.
Recommendation
Upgrade GrapheneOS to version 2026050400 or later, which includes a fix.
Original NVD description (English source)
GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.