Loading vulnerability…
Remote Code Execution in WhatsApp VoIP Stack
CVE-2019-3568 is a buffer-overflow vulnerability in the WhatsApp VoIP stack. An attacker could send a specially crafted series of SRTCP/RTCP packets in a WhatsApp call to a target phone number, causing remote code execution on affected clients. Exploitation did not require authentication, the target to answer the call, or other user interaction. Affected versions included WhatsApp and WhatsApp Business for Android and iOS, plus WhatsApp for Windows Phone and Tizen, before their respective patched releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthenticated, zero-click remote code execution on the target device. The flaw was used to deliver spyware, which could access decrypted chats and other device-resident data, eavesdrop on calls, activate the microphone or camera, and access photos and contacts.
If you can’t patch tonight, do this now.
Ensure all managed mobile devices running WhatsApp use current supported versions and receive security updates promptly. Investigate suspicious missed WhatsApp calls as a potential indicator of attempted exploitation, recognizing that call logs may be altered or removed following compromise.
Patch, then assume compromise.
Upgrade to WhatsApp for Android 2.19.134 or later, WhatsApp Business for Android 2.19.44 or later, WhatsApp for iOS 2.19.51 or later, WhatsApp Business for iOS 2.19.51 or later, WhatsApp for Windows Phone 2.18.348 or later, or WhatsApp for Tizen 2.18.15 or later. The issue was also addressed on WhatsApp servers on 2019-05-10. Enable automatic application and mobile operating-system updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.