CVE-2018-3988

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.

CVSS v3.1

4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.0

3.3 LOWCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CVSS v2.0

1.9 LOWAV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS

0.53% chance of exploitation in the next 30 days, 43th percentile

Published

2018-12-10

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0656

References

• CVE Record
• NVD entry

Related

• CVE-2018-3987
• CVE-2018-3989
• CVE-2018-3986
• CVE-2018-3990
• CVE-2018-3985
• CVE-2018-3991