CVE-2020-1909CWE-416

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory…

published November 3, 2020

CVSS
—
EPSS
2%
Percentile
83.0
In the wild
Unconfirmed
What it is

🚨 A use-after-free vulnerability hides in WhatsApp on iOS, waiting for the perfect moment to strike! 🎉 Think of this as a series of unfortunate events in a fancy restaurant: you place your order, but someone mistakenly takes away your dish while you're distracted by a juggling waiter, leaving you with an empty plate and potential chaos in the kitchen. If exploited, this vulnerability could lead to memory corruption and crashes during video calls, much like a restaurant's mishap causing diners to leave hungry. In the worst-case scenario, it could allow attackers to execute rogue code, compromising your device's integrity and privacy.

Put simply

Think of this as a series of unfortunate events in a fancy restaurant: you place your order, but someone mistakenly takes away your dish while you're distracted by a juggling waiter, leaving you with an empty plate and potential chaos in the kitchen. This use-after-free flaw occurs in a logging library, triggered specifically when receiving an animated sticker while putting a video call on hold. This sequence of events can lead to unintended memory access, resulting in crashes and potential code execution.

What to do

If exploited, this vulnerability could lead to memory corruption and crashes during video calls, much like a restaurant's mishap causing diners to leave hungry. In the worst-case scenario, it could allow attackers to execute rogue code, compromising your device's integrity and privacy. Update WhatsApp and WhatsApp Business for iOS immediately to version 2.20.111 or later to patch this vulnerability. Ensure that your app settings are configured to limit unintended interactions during calls. Regularly check for app updates to stay protected! You've got this! Stay vigilant and keep your apps updated for a safer experience! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02283 · 83.0th percentile
Weakness
CWE-416 · Use After Free
Published
2020-11-03T19:15Z
EPSS history
Timeline
  • 03 NOV 19:15Z
    A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory…
    cvelistv5