CVE-2025-24903: High severity libsignal-service-rs vulnerability
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user. The origin of sync messages is not checked. Patched libsignal-service can be found after commit 82d70f6720e762898f34ae76b0894b0297d9b2f8. The Metadata struct contains an additional wasencrypted field, which breaks the API, but should be easily resolvable. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24903?
CVE-2025-24903 is considered a high severity vulnerability that allows contact spoofing in the libsignal-service-rs library.
How do I fix CVE-2025-24903?
To fix CVE-2025-24903, update libsignal-service-rs to any version beyond commit 82d70f6720e762898f34ae76b0894b0297d9b2f8.
What systems are affected by CVE-2025-24903?
CVE-2025-24903 affects libsignal-service-rs versions prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8.
What type of attack is enabled by CVE-2025-24903?
CVE-2025-24903 enables a type of attack where an unauthorized contact can forge sync messages to impersonate another device of the user.
When was CVE-2025-24903 discovered?
CVE-2025-24903 was identified prior to the fix implemented in commit 82d70f6720e762898f34ae76b0894b0297d9b2f8.