ZDI-CAN-28556: ZDI-26-971: Signal for Windows Insufficient UI Warning Remote Code Execution Vulnerability

Published Nov 13, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Signal for Windows. User interaction is required to exploit this vulnerability in that the target must accept a malicious attachment. The ZDI has assigned a CVSS rating of 7.5.

Event History

Nov 13, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What must an attacker do to exploit this issue?

An attacker must send a malicious attachment and persuade the target to accept it. Exploitation requires user interaction; it is not described as a no-click attack.

What is the likely impact if exploitation succeeds?

A remote attacker can execute arbitrary code on the affected Signal for Windows installation.

How severe is this vulnerability?

ZDI assigned this issue a CVSS rating of 7.5.

ZDI-CAN-28556: ZDI-26-971: Signal for Windows Insufficient UI Warning Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the likely impact if exploitation succeeds?

How severe is this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker do to exploit this issue?

What is the likely impact if exploitation succeeds?

How severe is this vulnerability?