Actively exploited in the wild
WhatsApp VOIP Stack Buffer Overflow Vulnerability
Meta Platforms - WhatsApp · Listed in the CISA KEV since 2022-04-19. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-3568
CriticalCVSS 9.8KEVSummary
A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.
Risk Assessment
An attacker can remotely execute code on the victim's device, potentially leading to device takeover and data theft.
Recommendation
Update WhatsApp to the latest version on all platforms to receive security patches.
Other vulnerabilities in WhatsApp
See all- CVE-2025-55177MediumActively exploited
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device. This vulnerability, combined with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
- CVE-2026-23866Medium
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could allow a user to trigger processing of media content from an arbitrary URL on another user's device, including OS-controlled custom URL scheme handlers. No evidence of exploitation in the wild has been seen.
- CVE-2025-55179Medium
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user's device. No evidence of exploitation in the wild has been observed.
Original NVD description (English source)
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS