CVE-2025-55177mediumunder attackCWE-863

CVE-2025-55177: medium-severity vulnerability in Facebook WhatsApp for iOS

Published · Updated

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 5.4epss 4.7%
from disclosure to weapon238 days
Published on NVDAug 29
1st PoC+238d
CISA KEV+4d
exploitation probability
4.7%top 8% of all CVEs
observed exploitation
yesCISA + VulnCheck
2 public exploit(s)
Action required by CISAfederal deadline: 2025-09-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

WhatsApp for iOS and Mac had a flaw where unverified synchronization messages could trick a device into processing content from any website an attacker controls. This could be exploited alongside other Apple system vulnerabilities to attack specific users.

Technical detail

The vulnerability stems from incomplete authorization checks on linked device synchronization messages, allowing an unauthenticated attacker to inject arbitrary URLs for processing on a target device. Exploitation requires combining this flaw with CVE-2025-43300 (OS-level Apple vulnerability) to achieve impact in targeted attacks; the attack vector is network-based through malicious synchronization messages.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C
Affected products
Facebook · WhatsApp Business for iOSFacebook · WhatsApp Desktop for MacFacebook · WhatsApp for iOS
public PoCs found — 2
githubgithub.com/danielw98/zero-click-exploit-analysis★ 2vulncheckvulncheck.com/xdb/347d8d0fd11cunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Facebook WhatsApp for iOS

In the same product, most dangerous first.

CVE-2019-3568CRITICALCVE-2019-3568EPSS 30.1%KEVCVE-2020-1909—CVE-2020-1909EPSS 2.3%CVE-2018-20655—CVE-2018-20655EPSS 2.2%CVE-2018-6344HIGHCVE-2018-6344EPSS 1.9%CVE-2020-1907—CVE-2020-1907EPSS 1.9%CVE-2018-6350—CVE-2018-6350EPSS 1.7%
References
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177https://www.facebook.com/security/advisories/cve-2025-55177https://www.whatsapp.com/security/advisories/2025/