CVE-2019-9970

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-24 · updated 2026-06-17

Description

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

Affected products

Signal Private Messenger: through 4.35.3
Signal-Desktop: through 1.23.1

References

http://www.securityfocus.com/bid/107550
https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt
http://www.securityfocus.com/bid/107550
https://github.com/blazeinfosec/advisories/blob/master/signal-advisory.txt

Get alerted when CVE-2019-9970 or the next vulnerability affects your stack