CVE-2021-24042: facebook whatsapp business for android Heap-based Buffer Overflow

Vulnerability summary

CVE-2021-24042 is a critical (CVSS 9.8) Heap-based Buffer Overflow vulnerability in facebook whatsapp business for android. EPSS estimates a 1.24% chance of exploitation in the next 30 days, higher than 68.7% of scored vulnerabilities.

Timeline

1. 04-01-2022
   PublishedVulnerability first disclosed.
2. 22-05-2025
   Last modifiedVulnerability information updated.

Description

The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.