CVE-2018-20655CWE-121

When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow

published June 14, 2019

CVSS
—
EPSS
2%
Percentile
82.3
In the wild
Unconfirmed
What it is

⚠️ A missing size check in WhatsApp for iOS could lead to a stack-based overflow when receiving calls! Just like a waiter serving too much food on a plate, this glitch could lead to a messy situation! Picture a waiter who doesn't double-check the plate size before piling on a mountain of spaghetti. If he overfills it, the food spills over, creating a mess — this overflow vulnerability is just like that, allowing unexpected data to spill into critical memory areas. If exploited, an attacker could potentially manipulate memory, leading to crashes or unexpected behavior of the app. While there's currently no known exploitation, the consequences could be frustrating and mess up your communication!

Put simply

Picture a waiter who doesn't double-check the plate size before piling on a mountain of spaghetti. If he overfills it, the food spills over, creating a mess — this overflow vulnerability is just like that, allowing unexpected data to spill into critical memory areas. This vulnerability occurs due to a missing size check when parsing packets from the sender, resulting in a stack-based buffer overflow. This allows for potential memory corruption within the app.

What to do

If exploited, an attacker could potentially manipulate memory, leading to crashes or unexpected behavior of the app. While there's currently no known exploitation, the consequences could be frustrating and mess up your communication! Update your WhatsApp for iOS to version 2.18.90.24 or later immediately to patch this vulnerability. Encourage others to do the same and ensure their communication remains secure! You've got this! By updating promptly, you'll keep your app running smoothly and securely! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02196 · 82.3th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2019-06-14T17:02Z
EPSS history
Timeline
  • 14 JUN 17:02Z
    When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow
    cvelistv5