VULNERABILITY INTELLIGENCE

CVE-2018-3988

CVSS score4.7 MEDIUM

EPSS probability0.53%

CISA KEVNot currently listed

Published2018-12-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Signal Messenger for Android 4.24.8 may expose private information when using "disappearing messages." If a user uses the photo feature available in the "attach file" menu, then Signal will leave the picture in its own cache directory, which is available to any application on the system.

Weakness classification

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Primary references

talos-cna@cisco.com — Broken Link, Third Party Advisory, VDB Entry
talos-cna@cisco.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory