CVE-2019-3568criticalunder attackCWE-122

CVE-2019-3568: critical vulnerability in Facebook WhatsApp for Android

Published · Updated

Follow this CVE+ Monitor WhatsApp+ Monitor WhatsApp Business

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 30%
from disclosure to weapon
Published on NVDMay 14
CISA KEV+1071d
Action required by CISAfederal deadline: 2022-05-10

Apply updates per vendor instructions.

In short

A flaw in WhatsApp's voice call system allowed attackers to run malicious code on a phone by sending specially crafted network packets. This could let an attacker take full control of the device without the user needing to do anything.

Technical detail

Buffer overflow in the RTCP packet processing handler within WhatsApp's VOIP stack enables remote code execution when a target receives maliciously crafted RTCP packets. No user interaction required; exploitation occurs during call setup or active call sessions across multiple platforms (Android, iOS, Windows Phone, Tizen).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Facebook · WhatsApp Business for AndroidFacebook · WhatsApp Business for iOSFacebook · WhatsApp for AndroidFacebook · WhatsApp for iOSFacebook · WhatsApp for TizenFacebook · WhatsApp for Windows Phone
Related CVEs — Facebook WhatsApp for Android

In the same product, most dangerous first.

CVE-2025-55177MEDIUMCVE-2025-55177EPSS 13.5%KEVCVE-2019-11933—CVE-2019-11933EPSS 4.1%CVE-2021-24027—CVE-2021-24027EPSS 3.8%CVE-2020-1909—CVE-2020-1909EPSS 2.3%CVE-2018-6349—CVE-2018-6349EPSS 2.2%CVE-2018-20655—CVE-2018-20655EPSS 2.2%