CVE-2019-3568

high-risk
Published 2019-05-14

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Do I need to act?

!
45.6% chance of exploitation in next 30 days
EPSS score — higher than 54% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Affected Vendors

Whatsapp

References (5)

Broken Link http://www.securityfocus.com/bid/108329
Third Party Advisory https://www.facebook.com/security/advisories/cve-2019-3568
Broken Link http://www.securityfocus.com/bid/108329
Third Party Advisory https://www.facebook.com/security/advisories/cve-2019-3568
US Government Resource https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-...
69
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 24/34 · High
Exposure 13/34 · Low