Vulnerability · Published Nov 3, 2020 · Assigned by facebook
CVE-2020-1909
Critical 9.8
In plain English
A critical-severity use-after-free in WhatsApp Business for iOS from Facebook. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.3%top 16.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WhatsApp Business for iOS | 2.20.111unspecified – before 2.20.1112.20.81 – before unspecified | |
| WhatsApp for iOS | 2.20.111unspecified – before 2.20.1112.20.81 – before unspecified |
Weakness: CWE-416
References
- https://www.whatsapp.com/security/advisories/2020/ x_refsource_CONFIRM