Medium severity6.5OSV Advisory· Published Mar 24, 2019· Updated Jun 17, 2026

CVE-2019-9970

Description

Open Whisper Signal (aka Signal-Desktop) through 1.23.1 and the Signal Private Messenger application through 4.35.3 for Android are vulnerable to an IDN homograph attack when displaying messages containing URLs. This occurs because the application produces a clickable link even if (for example) Latin and Cyrillic characters exist in the same domain name, and the available font has an identical representation of characters from different alphabets.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Signalapp/Signal AndroidOSV
Range: 2.0.4, c53, v0.1.11, …
Signal/Private Messenger
cpe:2.3:a:signal:private_messenger:*:*:*:*:*:android:*:*
Range: <=4.35.3
Signal/Signal Desktop
cpe:2.3:a:signal:signal-desktop:*:*:*:*:*:*:*:*
Range: <=1.23.1
Open Whisper/Signal-Desktopllm-fuzzy
Range: <=1.23.1
Signal/Signalllm-fuzzy
Range: <=4.35.3

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/107550nvdThird Party AdvisoryVDB Entry
github.com/blazeinfosec/advisories/blob/master/signal-advisory.txtnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000