5.4
Medium
CVE-2025-55179 Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS…
Description
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| WhatsApp Business for iOS 2.25 | 2.25.8.14 → < 2.25.23.82 | 2.25.23.82 |
| WhatsApp for iOS 2.25 | 2.25.8.17 → < 2.25.23.73 | 2.25.23.73 |
| WhatsApp Desktop for Mac 2.25 | 2.25.8.14 → < 2.25.23.83 | 2.25.23.83 |
Other CVEs of WhatsApp Business for iOS
The 15 CVEs of WhatsApp Business for iOS →
CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
5.4
Medium
CVE-2023-38538
A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could…
5.0
Medium
CVE-2023-38537
A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced…
5.6
Medium
CVE-2021-24042
The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23,…
9.8
Critical