Attachment substitution via unvalidated cached files

Improper attachment validation in Signal Desktop before 6.2.0 allows local users to substitute cached files that the client later forwards. The client reuses files from attachments.noindex without validating existing cached content against attachment metadata, so a replaced file retains the displayed name and size when forwarded. Exploitation requires local access to the Signal data directory and a later forwarding action; Signal disputes the finding because such access is outside its threat model.