WH
Product
Whatsapp
On CISA KEVExploited in the wild
44
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 15High 13Medium 15Low 1
Watch
Add Whatsapp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-3568 In wildKEV | 9.8 | May 14 | WhatsApp VOIP Stack Buffer Overflow Vulnerability Affected: before 2.18.15; before 2.18.348; before 2.19.51; before 2.19.134 |
| CVE-2019-18426 In wildKEV | 8.2 | Jan 21 | WhatsApp Cross-Site Scripting Vulnerability Affected: before 0.3.9309; before 2.20.10 |
| CVE-2025-55177 In wildKEV | 5.4 | Aug 29 | Meta Platforms WhatsApp Incorrect Authorization Vulnerability Affected: 2.22.25.2 before 2.25.21.73; 2.22.25.2 before 2.25.21.78 |
| CVE-2022-36934 | 9.8 | Sep 22 | An integer overflow in WhatsApp could result in remote code execution in an established video call Affected: before 2.22.16.12; before 2.22.16.12 |
| CVE-2021-24042 | 9.8 | Jan 4 | The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior… Affected: before 2.21.23; before 2.21.23; before 2.21.230; before 2.21.230; before 2.2143; before 2.2146 |
| CVE-2021-24041 | 9.8 | Dec 7 | A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a… Affected: before 2.21.22.7 |
| CVE-2021-24026 | 9.8 | Apr 6 | A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for… Affected: before 2.21.3; before 2.21.3 |
| CVE-2020-1909 | 9.8 | Nov 3 | A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and… Affected: before 2.20.111 |
| CVE-2020-1907 | 9.8 | Oct 6 | A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS… Affected: before 2.20.90; before 2.20.196.16; before 173.0.0.29.505 |
| CVE-2020-1891 | 9.8 | Sep 3 | A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20,… Affected: before 2.20.17; before 2.20.20 |
| CVE-2019-11933 | 9.8 | Oct 23 | A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19, as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to execute arbitrary code… Affected: before 2.19.291 |
| CVE-2018-6350 | 9.8 | Jun 14 | An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers Affected: before 2.18.99; before 2.18.100.6; before 2.18.224 |
| CVE-2018-6349 | 9.8 | Jun 14 | When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow Affected: before 2.18.248 |
| CVE-2018-6339 | 9.8 | Jun 14 | When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in Affected: 2.18.180 before 2.18.295 |
| CVE-2018-20655 | 9.8 | Jun 14 | When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow Affected: before 2.18.90.24 |
| CVE-2021-24043 | 9.1 | Feb 2 | A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business… Affected: 2.21.23.2; 2.21.230.6; 2.2145.0 |
| CVE-2021-24035 | 9.1 | Jun 11 | A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal… Affected: before 2.21.8.13 |
| CVE-2020-1894 | 8.8 | Sep 3 | A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for… Affected: before 2.20.30; before 2.20.35 |
| CVE-2020-1886 | 8.8 | Sep 3 | A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a specially crafted… Affected: before 2.20.11 |
| CVE-2019-11932 | 8.8 | Oct 3 | A double free vulnerability in the DDGifSlurp function in decoding.c in the android-gif-drawable library before version 1.2.18, as used in WhatsApp for Android before version… Affected: before 2.19.244 |
| CVE-2022-27492 | 7.8 | Sep 23 | An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file Affected: before 2.22.15.9; before 2.22.16.2 |
| CVE-2020-1910 | 7.8 | Feb 2 | A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user… Affected: before 2.21.1.13 |
| CVE-2020-1906 | 7.8 | Oct 6 | A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing… Affected: before 2.20.130 |
| CVE-2019-11931 | 7.8 | Nov 14 | A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user Affected: through 2.18.368; before 2.19.100; before 2.19.274 |
| CVE-2019-11927 | 7.8 | Sep 27 | An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags in WEBP images Affected: before 2.9.143; before 2.19.100 |
| CVE-2021-24027 | 7.5 | Apr 6 | A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s… Affected: before 2.21.4.18 |
| CVE-2020-1902 | 7.5 | Oct 6 | A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could… Affected: 2.20.108 through 2.20.140 |
| CVE-2020-1890 | 7.5 | Sep 3 | A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing… Affected: before 2.20.11 |
| CVE-2018-6344 | 7.5 | Dec 31 | A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established Affected: before 2.18.93; before 2.18.172; before 2.18.293 |
| CVE-2025-30401 | 6.7 | Apr 5 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the… Affected: before 2.2450.6 |
| CVE-2026-23863 | 6.5 | May 1 | An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename… Affected: before 2.3000.1032164386.258709 |
| CVE-2020-20096 | 6.5 | Mar 23 | Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially… Affected: through 2.19.80; through 2.19.222 |
| CVE-2019-3566 | 5.9 | May 10 | A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent… Affected: 2.19.54 through 2.19.103; 2.19.52 |
| CVE-2023-38537 | 5.6 | Oct 4 | A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app… Affected: before 2.2338.12 |
| CVE-2020-1904 | 5.5 | Oct 6 | A path validation issue in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have allowed for directory traversal overwriting files when… Affected: before 2.20.61 |
| CVE-2020-1903 | 5.5 | Oct 6 | An issue when unzipping docx, pptx, and xlsx documents in WhatsApp for iOS prior to v2.20.61 and WhatsApp Business for iOS prior to v2.20.61 could have resulted in an… Affected: before 2.20.61 |
| CVE-2025-55179 | 5.4 | Nov 18 | Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have… Affected: 2.25.8.14 before 2.25.23.83; 2.25.8.17 before 2.25.23.73 |
| CVE-2020-1901 | 5.3 | Oct 6 | Receiving a large text message containing URLs in WhatsApp for iOS prior to v2.20.91.4 could have caused the application to freeze while processing the message Affected: before 2.20.91.4 |
| CVE-2019-3571 | 5.3 | Jul 16 | An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension Affected: before 0.3.3793; before 0.3.3793 |
| CVE-2023-38538 | 5.0 | Oct 4 | A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow… Affected: before 2.2320.2 |
| CVE-2020-1908 | 4.6 | Nov 3 | Improper authorization of the Screen Lock feature in WhatsApp and WhatsApp Business for iOS prior to v2.20.100 could have permitted use of Siri to interact with the WhatsApp… Affected: before 2.20.100 |
| CVE-2017-8769 | 4.6 | May 18 | Facebook WhatsApp Messenger before 2.16.323 for Android uses the SD card for cleartext storage of files (Audio, Documents, Images, Video, and Voice Notes) associated with a chat,… Affected: before 2.16.323 |
| CVE-2026-23866 | 4.3 | May 1 | Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have… Affected: 2.25.8.0 through 2.26.7.10; 2.25.8.0 through 2.26.15.72 |
| CVE-2020-1905 | 3.3 | Oct 6 | Media ContentProvider URIs used for opening attachments in other apps were generated sequentially prior to WhatsApp for Android v2.20.185, which could have allowed a malicious… Affected: before 2.20.185 |
Showing 44