ExpressVPN fixes a bug which could have disclosed user IP addresses

News
By published

A user reported the vulnerability

Computer graphic showing blue keyboard with multiple red warning triangle tabs
(Image credit: Olemedia / Getty Images)

ExpressVPN has updated its Windows app to patch a vulnerability which could have exposed a user's IP address to observers.

As one of the best VPNs, ExpressVPN is very secure but mistakes can happen. The provider said in a blog post that code meant for internal testing "mistakenly made it into production builds."

Only users in specific conditions were affected, but the bug meant traffic wasn't being routed through the VPN tunnel as expected – however encryption was not impacted.

Community assistance

The code meant for internal testing found its way into production build versions 12.97 to 12.101.0.2-beta.

It was reported to ExpressVPN in April 2025 by security researcher Adam-X through the provider's bug bounty program – where security researchers can earn cash rewards for reporting vulnerabilities and flaws.

ExpressVPN said its team confirmed and triaged the report within hours.

The vulnerability centred around Remote Desktop Protocol (RDP). According to ExpressVPN there was only a risk when an RDP connection was in use or when other TCP traffic was routed over port 3389.

ExpressVPN said "if a user established a connection using RDP, that traffic could bypass the VPN tunnel."

"This did not affect encryption, but it meant that traffic from RDP connections wasn’t routed through ExpressVPN as expected."

It added that observers such as internet service providers could see that a user was connected to ExpressVPN and that they were using RDP to access remote servers – information that would ordinarily be protected.

RDP is most commonly used in enterprise environments, and therefore most users were unaffected. However ExpressVPN said it considers "any risk to privacy unacceptable."

A fix was released five days later in version 12.101.0.45. The researcher confirmed the issue was resolved and ExpressVPN closed the report at the end of June.

Red ExpressVPN logo displayed on black smartphone screen

(Image credit: SOPA Images / Getty Images)

How severe could this have been?

ExpressVPN analysed the issues and believed "the likelihood of real-world exploitation was extremely low."

Given the fact a majority of ExpressVPN users are individuals as opposed to enterprise customers, the provider said "the number of affected users is likely small."

For a hacker to exploit the vulnerability, they would've needed to be aware of the bug and find a way to route traffic over port 3389. This could've been done by tricking a user into clicking on a malicious link or compromising a popular website to launch a drive-by attack – all while the user was connected to the VPN.

As demonstrated by Adam-X, a user's real IP address could've been revealed. But browsing activity couldn't have been seen and encryption was not compromised.

ExpressVPN said it was grateful to its community for notifying it of potential issues and suggesting improvements. The provider will strengthen its internal safeguards to ensure this doesn't happen again.

Disclaimer

We test and review VPN services in the context of legal recreational uses. For example: 1. Accessing a service from another country (subject to the terms and conditions of that service). 2. Protecting your online security and strengthening your online privacy when abroad. We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

George Phillips
George Phillips
Staff Writer

George is a Staff Writer at Tom's Guide, covering VPN, privacy, and cybersecurity news. He is especially interested in digital rights and censorship, and its interplay with politics. Outside of work, George is passionate about music, Star Wars, and Karate.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.