Vulnerability · Published Mar 19, 2025 · Assigned by mitre
CVE-2025-30259
Low 3.5
In plain English
A low-severity security flaw in WhatsApp cloud service from Meta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.3%top 82.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Meta | WhatsApp cloud service | 0 – before late 2024 |