CVE-2025-55177: Meta Platforms WhatsApp Incorrect Authorization Vulnerability

Description

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)13.1% · higher than 96% of CVEs

Exploited in the wildYes

CISA KEVListed Sep 2, 2025

Federal remediation dueSep 23, 2025

Ransomware campaign useNot known

Affected products

Which versions

WB

WhatsApp Business for iOS · Facebook

2.22.25.2 before 2.25.21.78 · source: vendor

WD

WhatsApp Desktop for Mac · Facebook

2.22.25.2 before 2.25.21.78 · source: vendor

WF

WhatsApp for iOS · Facebook

2.22.25.2 before 2.25.21.73 · source: vendor

WH

Whatsapp · Whatsapp

2.22.25.2 before 2.25.21.73; 2.22.25.2 before 2.25.21.78 · source: NVD, KEV

WB

Whatsapp Business · Whatsapp

2.22.25.2 before 2.25.21.78 · source: NVD