CVE-2019-17192
9.8
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee chooses to answer a call, which might make it easier for remote attackers to cause a denial of service or possibly have unspecified other impact via malformed packets. NOTE: the vendor plans to continue this behavior for performance reasons unless a WebRTC design change occurs
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.73% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-670 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-10-05 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| signal | private messenger |
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1936
- https://news.ycombinator.com/item?id=21161432
- https://twitter.com/moxie/status/1180226374851710976
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1936
- https://news.ycombinator.com/item?id=21161432
- https://twitter.com/moxie/status/1180226374851710976
→ the Explorer · watch your stack · NVD