CVE-2021-24043

moderate-risk
Published 2022-02-02

A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.

Do I need to act?

-
0.57% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Affected Vendors

Whatsapp

References (3)

Not Applicable https://www.whatsapp.com/security/advisories/2021/
Vendor Advisory https://www.whatsapp.com/security/advisories/2022/
Not Applicable https://www.whatsapp.com/security/advisories/2021/
45
/ 100
moderate-risk
Severity 31/34 · Critical
Exploitability 2/34 · Minimal
Exposure 12/34 · Low