CVE-2020-5753: Signal Private Messenger

Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim's Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.

Affected products

• Signal Private Messenger: up to and including 4.59.0
• Signal Signal: up to and including 3.8.1.5

Published 2020-05-20. Last modified 2026-06-17.