CVE-2019-3568
CVE-2019-3568
In short
A flaw in WhatsApp's voice call system allowed attackers to run malicious code on a phone by sending specially crafted network packets. This could let an attacker take full control of the device without the user needing to do anything.
Technical detail
Buffer overflow in the RTCP packet processing handler within WhatsApp's VOIP stack enables remote code execution when a target receives maliciously crafted RTCP packets. No user interaction required; exploitation occurs during call setup or active call sessions across multiple platforms (Android, iOS, Windows Phone, Tizen).
Summary generated and translated by AI from the official description.
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Facebook · WhatsApp Business for AndroidFacebook · WhatsApp Business for iOSFacebook · WhatsApp for AndroidFacebook · WhatsApp for iOSFacebook · WhatsApp for TizenFacebook · WhatsApp for Windows PhoneWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →