> CVE-2023-24068 && CVE-2023-24069: Abusing Signal Desktop Client for fun and for Espionage

Identification While using signal, it was observed that the preview of an image was still visible even after having deleted the image because the image had been “replied” to. After looking through multiple files, the culprit directory was identified. C:\Users\foo\AppData\Roaming\Signal\attachments.noindex\*\ To replicate, an image was sent in a group chat The image was stored as a regular file in this directory, and the image can be recovered by modifying the extension and adding .