Loading vulnerability…
WhatsApp for Windows NUL Byte Attachment Spoofing
CVE-2026-23863 is an attachment-spoofing vulnerability in WhatsApp for Windows versions earlier than 2.3000.1032164386.258709. Improper neutralization of embedded NUL characters in attachment filenames creates inconsistent interpretation between the application’s display logic and the native Windows handling of the filename. A malicious executable can consequently be presented in WhatsApp as an apparently benign document or image while Windows treats the attachment as an executable when it is opened.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A successful attack can deceive a recipient into opening malware that appears to be a non-executable attachment. The payload then executes in the security context of the current Windows user, enabling arbitrary code execution with that user’s privileges. No exploitation in the wild has been reported.
If you can’t patch tonight, do this now.
Until all clients are updated, restrict execution of untrusted executables from user-writable locations using Windows Defender Application Control or AppLocker, and ensure endpoint protection scans and blocks malicious attachments. Monitor for executable files written by WhatsApp and suspicious child processes originating from WhatsApp, particularly where file content does not match the displayed document type. Train users to treat unexpected attachments as untrusted, including those received from known contacts.
Patch, then assume compromise.
Update WhatsApp for Windows to version 2.3000.1032164386.258709 or later, which addresses the unsafe handling of NUL characters in attachment filenames. Organizations should verify deployed Windows clients are on a fixed release and enable or enforce timely application updates where possible.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.