A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWhatsapp
APPWhatsapp< 2.18.15< 2.18.348< 2.19.51< 2.19.134Whatsapp Business
APPWhatsapp< 2.19.44< 2.19.51
CISA KEV — detailsi
- Vendori
- Meta Platforms
- Producti
- Added to KEVi
- April 19, 2022
- Remediation deadline (US Federal)i
- May 10, 2022(overdue)
Apply updates per vendor instructions.
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Related vulnerabilities
An integer overflow in WhatsApp could result in remote code execution in an established video call.
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business fo...
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23,...
A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business f...
A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Bu...