Whatsapp vulnerabilities, page 3
46 vulnerabilities
Known vulnerabilities in Whatsapp products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 6 products.
CVE-2019-3571facebookwhatsapp desktop+1
EPSS score0.78%
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.CVE-2019-3566facebookwhatsapp business for android+3EPSS score1.07%
A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly. This issue affects WhatsApp for Android 2.19.52 and 2.19.54 - 2.19.103, as well as WhatsApp Business for Android starting in v2.19.22 until v2.19.38.CVE-2026-23866facebookwhatsapp for android+2EPSS score0.46%
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.CVE-2026-23863facebookwhatsapp desktop for windows+1EPSS score0.53%
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.CVE-2023-38537facebookwhatsapp business for android+6EPSS score0.28%
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.CVE-2023-38538facebookwhatsapp business for android+6EPSS score0.23%
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.