Vulnerability Intelligence Report
CVE-2018-6344
A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of service. It affects WhatsApp for Android prior to v2.18.293, WhatsApp for iOS prior to v2.18.93, and WhatsApp for Windows Phone prior to v2.18.172.
No Active Exploit Signals
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:1.95%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-122 ↗Heap-based Buffer Overflow (CWE-122)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WhatsApp for Android | 2.18.293 (affected), unspecified < 2.18.293 (affected) | |
| WhatsApp for iOS | 2.18.93 (affected), unspecified < 2.18.93 (affected) | |
| WhatsApp for Windows Phone | 2.18.172 (affected), unspecified < 2.18.172 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.949%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | |
| Reserved | 2018-01-26T00:00:00 |
| Published | 2018-12-31T22:00:00 |
| Patch Date | 2018-12-31 |
| Last Updated | 2025-05-06T16:02:35 |
Community Chatter & Buzz