Actively exploited · Published May 14, 2019 · Assigned by facebook

CVE-2019-3568

Critical 9.8 Exploited

In plain English

A critical-severity heap buffer overflow in WhatsApp Business for Android from Facebook. Attackers are actively exploiting it in the wild (listed by CISA on April 19, 2022). The chance it is exploited in the next 30 days is estimated at 30.1% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)30.1%top 1.8% of all CVEs

Exploited in the wildYesCISA KEV since Apr 19, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by May 10, 2022.

Official description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Affected products (as reported)

Vendor	Product	Versions
Facebook	WhatsApp for Android	2.19.134unspecified – before 2.19.134
Facebook	WhatsApp Business for Android	2.19.44unspecified – before 2.19.134
Facebook	WhatsApp for iOS	2.19.51unspecified – before 2.19.51
Facebook	WhatsApp Business for iOS	2.19.51unspecified – before 2.19.51
Facebook	WhatsApp for Windows Phone	2.18.348unspecified – before 2.18.348
Facebook	WhatsApp for Tizen	2.18.15unspecified – before 2.18.15

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.facebook.com/security/advisories/cve-2019-3568 x_refsource_MISC
108329 vdb-entry, x_refsource_BID
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568 government-resource