High severity · published Aug 29, 2018
CVE-2018-16132
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating…
8.6
CVSS
1.1%
EPSS
No
On KEV
Description
The image rendering component (createGenericPreview) of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed, resulting in a forced restart of the device.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SI
Signal · Signal
through 2.29.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-16132
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-16132
Mailing List
http://seclists.org/bugtraq/2018/Aug/57
More from Signal
7.5
CVE-2022-28345
The Signal app before 5.34 for iOS allows URI spoofing via RTLO injection
6.8
CVE-2018-9840
The Open Whisper Signal app before 2.23.2 for iOS allows physically proximate attackers to bypass the screen locker feature via certain rapid sequences of actions that include app…
6.4
CVE-2025-5715
Signal App Biometric Authentication missing critical step in authentication
5.3
CVE-2020-5753
Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to…