CVE-2019-3568

WhatsApp VOIP Stack Buffer Overflow Vulnerability

Meta Platforms WhatsAppApplications & CMS

CVSS

9.8Critical

ExploitationExploited in the wildAdded to KEV 19 Apr 2022CISA KEV

Exploit odds (EPSS)30.1%Chance of exploitation activity in the next 30 days, higher than 98% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in2.19.134Also 2.19.51, 2.18.348 and 1 moreCVE List

Federal deadline10 May 2022Remediation due date for US federal agenciesCISA KEV

CISA required actionApply updates per vendor instructions. CISA KEV

What fixes it

2.19.134WhatsApp for AndroidCVE List
2.19.134WhatsApp Business for AndroidCVE List
2.19.51WhatsApp for iOSCVE List
2.19.51WhatsApp Business for iOSCVE List
2.18.348WhatsApp for Windows PhoneCVE List
2.18.15WhatsApp for TizenCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

14 May 2019, 19:52 UTCPublishedCVE List
19 Apr 2022Added to CISA KEVCISA KEV

Description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.

Text from CVE List

Affected versions 12

WhatsApp for Androidaffected: 2.19.134CVE List
WhatsApp for Androidaffected: unspecified before 2.19.134CVE List
WhatsApp Business for Androidaffected: 2.19.44CVE List
WhatsApp Business for Androidaffected: unspecified before 2.19.134CVE List
WhatsApp for iOSaffected: 2.19.51CVE List
WhatsApp for iOSaffected: unspecified before 2.19.51CVE List
WhatsApp Business for iOSaffected: 2.19.51CVE List
WhatsApp Business for iOSaffected: unspecified before 2.19.51CVE List
WhatsApp for Windows Phoneaffected: 2.18.348CVE List
WhatsApp for Windows Phoneaffected: unspecified before 2.18.348CVE List
WhatsApp for Tizenaffected: 2.18.15CVE List
WhatsApp for Tizenaffected: unspecified before 2.18.15CVE List