CVE-2021-24042criticalCWE-122CWE-787

CVE-2021-24042: critical vulnerability in Facebook WhatsApp for Android

Published · Updated

Follow this CVE+ Monitor WhatsApp+ Monitor WhatsApp Business

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.3%
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Facebook · WhatsApp Business for AndroidFacebook · WhatsApp Business for iOSFacebook · WhatsApp DesktopFacebook · WhatsApp for AndroidFacebook · WhatsApp for iOSFacebook · WhatsApp for KaiOS
Related CVEs — Facebook WhatsApp for Android

In the same product, most dangerous first.

CVE-2019-18426HIGHCVE-2019-18426EPSS 67.9%KEVCVE-2019-3568CRITICALCVE-2019-3568EPSS 30.1%KEVCVE-2025-55177MEDIUMCVE-2025-55177EPSS 13.5%KEVCVE-2020-1889—CVE-2020-1889EPSS 4.8%CVE-2021-24027—CVE-2021-24027EPSS 3.8%CVE-2020-1909—CVE-2020-1909EPSS 2.3%