Vulnerability Intelligence Report
WhatsApp VOIP Stack Buffer Overflow Vulnerability
CVE-2019-3568
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
CISA KEV
SSVC: Active Exploitation
Automatable
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:39.17%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-122 ↗Heap-based Buffer Overflow (CWE-122)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WhatsApp for Android | 2.19.134 (affected), unspecified < 2.19.134 (affected) | |
| WhatsApp Business for Android | 2.19.44 (affected), unspecified < 2.19.134 (affected) | |
| WhatsApp for iOS | 2.19.51 (affected), unspecified < 2.19.51 (affected) | |
| WhatsApp Business for iOS | 2.19.51 (affected), unspecified < 2.19.51 (affected) | |
| WhatsApp for Windows Phone | 2.18.348 (affected), unspecified < 2.18.348 (affected) | |
| WhatsApp for Tizen | 2.18.15 (affected), unspecified < 2.18.15 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | |
| Reserved | 2019-01-02T00:00:00 |
| Published | 2019-05-14T19:52:40 |
| Last Updated | 2025-10-21T23:45:37 |
Community Chatter & Buzz