High severity · published Sep 3, 2020
CVE-2020-1894
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for…
8.8
CVSS
1.8%
EPSS
No
On KEV
Description
A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk message.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Whatsapp · Whatsapp
before 2.20.30; before 2.20.35 · source: NVD
WB
Whatsapp Business · Whatsapp
before 2.20.20; before 2.20.30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1894
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1894
Vendor Advisory
https://www.whatsapp.com/security/advisories/2020
More from Whatsapp
9.8
CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
8.2
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
5.4
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
9.8
CVE-2022-36934
An integer overflow in WhatsApp could result in remote code execution in an established video call
9.8
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior…