CVE-2025-24904: High severity libsignal-service-rs vulnerability
libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, plaintext content envelopes could be injected by a server or a malicious client, and may have been able to bypass the end-to-end encryption and authentication. The vulnerability is fixed per 82d70f6720e762898f34ae76b0894b0297d9b2f8. The Metadata struct contains an additional wasencrypted field, which breaks the API, but should be easily resolvable. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24904?
CVE-2025-24904 has been classified as a high severity vulnerability due to the potential for plaintext content envelope injection.
How do I fix CVE-2025-24904?
To fix CVE-2025-24904, update the libsignal-service-rs library to a version that is equal to or greater than commit 82d70f6720e762898f34ae76b0894b0297d9b2f8.
What types of systems are affected by CVE-2025-24904?
CVE-2025-24904 primarily affects systems utilizing the libsignal-service-rs library prior to the specified commit.
Is CVE-2025-24904 a remote vulnerability?
Yes, CVE-2025-24904 can be exploited remotely through server or client interactions that inject plaintext content.
What are the potential impacts of CVE-2025-24904?
The potential impacts of CVE-2025-24904 include unauthorized access to sensitive information due to the injection of plaintext content envelopes.