Critical severity · published Jun 14, 2019
CVE-2018-6350
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsapp · Whatsapp
before 2.18.99; before 2.18.100.6; before 2.18.224 · source: NVD
WB
Whatsapp Business · Whatsapp
before 2.18.100.2; before 2.18.276 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6350
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6350
www.securityfocus.com
http://www.securityfocus.com/bid/108803
Third Party Advisory
https://www.facebook.com/security/advisories/cve-2018-6350/
More from Whatsapp
9.8
CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
8.2
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
5.4
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
9.8
CVE-2022-36934
An integer overflow in WhatsApp could result in remote code execution in an established video call
9.8
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior…