9.8
Critical
CVE-2021-24042 The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23,…
Description
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WhatsApp Desktop 2.2146 | earliest → < 2.2146 | 2.2146 |
| WhatsApp for KaiOS 2.2143 | earliest → < 2.2143 | 2.2143 |
| WhatsApp Business for iOS 2.21 | earliest → < 2.21.230 | 2.21.230 |
| WhatsApp for iOS 2.21 | earliest → < 2.21.230 | 2.21.230 |
| WhatsApp Business for Android 2.21 | earliest → < 2.21.23 | 2.21.23 |
| WhatsApp for Android 2.21 | earliest → < 2.21.23 | 2.21.23 |
Other CVEs of WhatsApp Desktop
The 5 CVEs of WhatsApp Desktop →
CVE-2020-1889
A security feature bypass issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed for sandbox escape in…
Not rated
CVE-2019-11928
An input validation issue in WhatsApp Desktop versions prior to v0.3.4932 could have allowed cross-site scripting upon…
Not rated
CVE-2019-18426
WhatsApp Cross-Site Scripting Vulnerability
8.2
High
CVE-2019-3571
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send…
Not rated