CVE-2018-6350CWE-125

An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers

published June 14, 2019

CVSS
—
EPSS
2%
Percentile
76.8
In the wild
Unconfirmed
What it is

⚠️ A sneaky little out-of-bounds read is hiding in WhatsApp, lurking in the parsing of RTP extension headers! 📱 Think of it as a restaurant that misreads an order, serving you someone else’s meal instead of your own. In this case, WhatsApp may inadvertently read data from outside its designated buffet table, exposing private information. If exploited, an attacker could potentially read sensitive data from memory, leading to privacy breaches that could be surprisingly devastating for users. Imagine your private conversations becoming fodder for prying eyes, all because of a little miscommunication!

Put simply

Think of it as a restaurant that misreads an order, serving you someone else’s meal instead of your own. In this case, WhatsApp may inadvertently read data from outside its designated buffet table, exposing private information. This vulnerability arises from incorrect parsing of RTP extension headers, allowing an out-of-bounds read in WhatsApp on multiple platforms, including Android and iOS, prior to specified versions.

What to do

If exploited, an attacker could potentially read sensitive data from memory, leading to privacy breaches that could be surprisingly devastating for users. Imagine your private conversations becoming fodder for prying eyes, all because of a little miscommunication! To protect yourself, update WhatsApp immediately to the latest versions: 2.18.276 for Android, 2.18.100.6 for iOS, and 2.18.224 for Windows Phone. Keeping your apps updated ensures you stay safe from such vulnerabilities! 🛡️ You've got this! Stay vigilant and keep your apps secure! ✨

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01693 · 76.8th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2019-06-14T17:02Z
EPSS history
Timeline
  • 14 JUN 17:02Z
    An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers
    cvelistv5