CVE-2018-6339CWE-121

When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in

published June 14, 2019

CVSS
—
EPSS
2%
Percentile
74.7
In the wild
Unconfirmed
What it is

🚨 An off-by-one error in WhatsApp for Android could cause serious stack mayhem during calls! Think of it like a waiter trying to serve a dish but miscalculating the portion size — too much food spills over the plate, making a mess. In this case, the error allows data to overflow beyond its allocated space, creating potential chaos. If exploited, this could lead to unexpected behavior or crashes during calls, leaving users frustrated and vulnerable. Imagine your phone dropping calls unexpectedly or worse, running rogue code! That's absolutely devastating for a communication app!

Put simply

Think of it like a waiter trying to serve a dish but miscalculating the portion size — too much food spills over the plate, making a mess. In this case, the error allows data to overflow beyond its allocated space, creating potential chaos. This vulnerability arises from a failure to properly account for the data size in stack allocation, which results in writing beyond the intended memory space. It affects WhatsApp for Android starting from version 2.18.180 and WhatsApp Business for Android from version 2.18.103.

What to do

If exploited, this could lead to unexpected behavior or crashes during calls, leaving users frustrated and vulnerable. Imagine your phone dropping calls unexpectedly or worse, running rogue code! That's absolutely devastating for a communication app! Update WhatsApp on Android to version 2.18.295 or later, and for WhatsApp Business, ensure you’re using version 2.18.150 or higher. Regularly check for updates to keep your apps secure. You've got this! Stay vigilant and keep those apps updated for smooth sailing! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01540 · 74.7th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2019-06-14T17:02Z
EPSS history
Timeline
  • 14 JUN 17:02Z
    When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in
    cvelistv5