Signal vulnerabilities
We track 2 vulnerabilities in Signal products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
2vulnerabilities
1critical
1high
0exploited
8.4average CVSS score
Latest Signal vulnerabilities
- 9.3 Critical severity
RingRTC: Improper Check for Unusual or Exceptional Conditions
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.
- 7.5 High severity
Signal: Improper Neutralization of Special Elements in Output Used by a Downstream Component
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection. It incorrectly renders RTLO encoded URLs beginning with a non-breaking space, when there is a hash character in the URL. This technique allows a remote unauthenticated attacker to send