Meta Patches Two WhatsApp Flaws Affecting Windows, Android, and iOS
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen May 24, 2026
Meta disclosed and fixed two medium-severity WhatsApp vulnerabilities reported through its bug bounty program, saying it found no evidence of in-the-wild exploitation. The first flaw, CVE-2026-23863, affected WhatsApp for Windows and could let a specially crafted attachment use hidden NUL bytes in a filename to appear as a harmless file such as a PDF while executing as a different file type when opened.
The second flaw, CVE-2026-23866, affected WhatsApp on Android and iOS and stemmed from incomplete validation tied to Instagram Reels sharing and AI-driven message response handling, potentially causing the app to process media from an arbitrary URL or invoke OS-level custom URL scheme handlers. Meta said both issues were patched in April via updates to WhatsApp and advised users to install the latest app and device updates.
