CVE-2021-24041CWE-122

A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an…

published December 7, 2021

CVSS
—
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

⚠️ A crafty image could slip right past the curtains! A missing bounds check in WhatsApp’s image blurring code could allow malicious images to wreak havoc, especially in versions prior to v2.21.22.7. 🚨 Think of this like a restaurant where the chef accidentally leaves the door to the kitchen open. A mischievous customer could toss in something unsavory without anyone noticing, causing chaos before it's even discovered! An attacker could potentially send a malicious image that leads to an out-of-bounds write, resulting in unexpected behavior or crashes in the app. While we’re not looking at anything catastrophic at the moment, the possibility for disruption is still concerning!

Put simply

Think of this like a restaurant where the chef accidentally leaves the door to the kitchen open. A mischievous customer could toss in something unsavory without anyone noticing, causing chaos before it's even discovered! This vulnerability exists due to a missing bounds check in the image blurring feature, allowing out-of-bounds memory access when processing specially crafted images.

What to do

An attacker could potentially send a malicious image that leads to an out-of-bounds write, resulting in unexpected behavior or crashes in the app. While we’re not looking at anything catastrophic at the moment, the possibility for disruption is still concerning! Update WhatsApp to version 2.21.22.7 or later to patch this vulnerability. Additionally, be cautious when receiving images from unknown sources until you're updated. Regularly check for app updates to ensure you're protected! You've got this! Stay vigilant and keep those apps updated for a smoother experience! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01246 · 69.1th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2021-12-07T19:10Z
EPSS history
Timeline
  • 07 DEC 19:10Z
    A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an…
    cvelistv5