6.7

CVE-2025-30401: facebook whatsapp desktop for windows

CVSS: 6.7v3.1MediumModified
Published 05-04-2025Last modified 09-04-2025
Open JSON

Vulnerability summary

CVE-2025-30401 is a medium (CVSS 6.7) vulnerability in facebook whatsapp desktop for windows. EPSS estimates a 20.99% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
20.99%
0%100%
High · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 05-04-2025
    PublishedVulnerability first disclosed.
  2. 09-04-2025
    Last modifiedVulnerability information updated.

Description

A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

20.99%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 20.99% on 20-09-2026

20-09-202620-10-2026
EPSS score
20.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Facebook1 product
Whatsapp1 product

2 vendors · 2 products

References

2 links