Critical severity · published Jun 14, 2019
CVE-2018-6339
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in
9.8
CVSS
1.5%
EPSS
No
On KEV
Description
When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsapp · Whatsapp
2.18.180 before 2.18.295 · source: NVD
WB
Whatsapp Business · Whatsapp
2.18.103 before 2.18.150 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6339
Third Party Advisory
https://www.facebook.com/security/advisories/cve-2018-6339/
More from Whatsapp
9.8
CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
8.2
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
5.4
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
9.8
CVE-2022-36934
An integer overflow in WhatsApp could result in remote code execution in an established video call
9.8
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior…