Medium severity · published May 10, 2019
CVE-2019-3566
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent…
5.9
CVSS
1.1%
EPSS
No
On KEV
Description
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsapp · Whatsapp
2.19.54 through 2.19.103; 2.19.52 · source: NVD
WB
Whatsapp Business · Whatsapp
2.19.22 through 2.19.38 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3566
Third Party Advisory
https://www.facebook.com/security/advisories/cve-2019-3566
More from Whatsapp
9.8
CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
8.2
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
5.4
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
9.8
CVE-2022-36934
An integer overflow in WhatsApp could result in remote code execution in an established video call
9.8
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior…