CVE-2021-24041: Heap-based Buffer Overflow

A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malicious image...

CVE-2021-24035: Relative Path Traversal

A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files...

PT-2021-15657

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions prior to 2.21.8.13 WhatsApp Business for Android versions prior to 2.21.8.13 Description: The issue is related to a lack of filename validation when unzipping archives, which could have allowed path traversal...

CVE-2021-24027: Use of Cache Containing Sensitive Information

A cache configuration issue prior to WhatsApp for Android v2.21.4.18 and WhatsApp Business for Android v2.21.4.18 may have allowed a third party with access to the device’s external storage to read cached TLS material...

CVE-2020-1910: Out-of-bounds Write

A missing bounds check in WhatsApp for Android prior to v2.21.1.13 and WhatsApp Business for Android prior to v2.21.1.13 could have allowed out-of-bounds read and write if a user applied specific image filters to a specially crafted image and sent the resulting image...

PT-2020-15160

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.20.130 WhatsApp Business for Android versions prior to 2.20.46 Description A buffer overflow could occur when processing malformed local videos with E-AC-3 audio streams, potentially allowing an...

PT-2020-15156

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions 2.20.108 through 2.20.140 WhatsApp Business for Android versions 2.20.35 through 2.20.49 Description A user running a quick search on a highly forwarded message could have been sent to the Google service over plai...

CVE-2020-1902: Exposure of Sensitive Information to an Unauthorized Actor

A user running a quick search on a highly forwarded message on WhatsApp for Android from v2.20.108 to v2.20.140 or WhatsApp Business for Android from v2.20.35 to v2.20.49 could have been sent to the Google service over plain HTTP...

CVE-2020-1906: Heap-based Buffer Overflow

A buffer overflow in WhatsApp for Android prior to v2.20.130 and WhatsApp Business for Android prior to v2.20.46 could have allowed an out-of-bounds write when processing malformed local videos with E-AC-3 audio streams...

CVE-2020-1907: Out-of-bounds Write

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when...

PT-2020-15146

Name of the Vulnerable Software and Affected Versions WhatsApp for Android versions prior to 2.20.11 WhatsApp Business for Android versions prior to 2.20.2 Description A URL validation issue could cause the recipient of a sticker message with deliberately malformed data to load an image from a...

CVE-2020-1890: Improper Input Validation

A URL validation issue in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have caused the recipient of a sticker message containing deliberately malformed data to load an image from a sender-controlled URL without user interaction...

CVE-2020-1886: Buffer Copy without Checking Size of Input

A buffer overflow in WhatsApp for Android prior to v2.20.11 and WhatsApp Business for Android prior to v2.20.2 could have allowed an out-of-bounds write via a specially crafted video stream after receiving and answering a malicious video call...

CVE-2018-6349: Stack-based Buffer Overflow

When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132...

PT-2019-11021

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions prior to 2.18.248 WhatsApp Business for Android versions prior to 2.18.132 Description: A missing size check when parsing a sender-provided packet allowed for a stack-based overflow, which occurs when receiving...

CVE-2019-3566: Improper Access Control

A bug in WhatsApp for Android's messaging logic would potentially allow a malicious individual who has taken over over a WhatsApp user's account to recover previously sent messages. This behavior requires independent knowledge of metadata for previous messages, which are not available publicly...