CVE-2019-17192

CRITICAL 9.8CVE-2019-17192 · Published 05/10/2019 · updated 17/06/2026

In short

CVE-2019-17192 is a CRITICAL (CVSS 9.8) vulnerability affecting private messenger (signal).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
private messenger signal	`≤ 4.47.7`	No fix yet

Description

The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs

References

bugs.chromium.org/p/project-zero/issues/detail · Third Party Advisory
news.ycombinator.com/item · Third Party Advisory
twitter.com/moxie/status/1180226374851710976 · Third Party Advisory

More vulnerabilities in private messenger

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

private messenger

signal

≤ 4.47.7

No fix yet

Description

More vulnerabilities in private messenger

See all →