Whatsapp: >> Whatsapp Security Vulnerabilities
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachmentâs filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
CVSS Score
6.7
EPSS Score
0.001
Published
2025-04-05
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.
CVSS Score
5.0
EPSS Score
0.001
Published
2023-10-04
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.
CVSS Score
5.6
EPSS Score
0.001
Published
2023-10-04
An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.
CVSS Score
7.8
EPSS Score
0.016
Published
2022-09-23
An integer overflow in WhatsApp could result in remote code execution in an established video call.
CVSS Score
9.8
EPSS Score
0.079
Published
2022-09-22
Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.
CVSS Score
6.5
EPSS Score
0.004
Published
2022-03-23
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.
CVSS Score
9.1
EPSS Score
0.006
Published
2022-02-02
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
CVSS Score
9.8
EPSS Score
0.005
Published
2022-01-04
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image.
CVSS Score
9.8
EPSS Score
0.006
Published
2021-12-07
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files.
CVSS Score
9.1
EPSS Score
0.005
Published
2021-06-11
Page 1