CVE-2021-24042CWE-122

The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp…

Critical · published January 4, 2022

CVSS v3.1
9.8
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

🚨 A malicious call could turn your phone into a hacker's playground! This critical out-of-bounds write vulnerability affects WhatsApp across various platforms and versions, leaving users at risk. 🔥 Think of it like a phone line that allows someone to send commands directly into your house while you're on a call — they could change the locks or even unlock the door without you knowing! An attacker could exploit this vulnerability during a voice call, leading to unauthorized actions on your device. This could result in data breaches, unauthorized access to your messages, or even remote code execution. It's absolutely devastating given the widespread use of WhatsApp!

Put simply

Think of it like a phone line that allows someone to send commands directly into your house while you're on a call — they could change the locks or even unlock the door without you knowing! The vulnerability arises from a flaw in the calling logic that permits an out-of-bounds write, allowing attackers to manipulate the memory of the application during a 1:1 call. This can lead to unpredictable behavior and potentially allowing the execution of arbitrary code.

What to do

An attacker could exploit this vulnerability during a voice call, leading to unauthorized actions on your device. This could result in data breaches, unauthorized access to your messages, or even remote code execution. It's absolutely devastating given the widespread use of WhatsApp! Update WhatsApp to the latest version immediately: v2.21.23 for Android and iOS, v2.2143 for KaiOS, and v2.2146 for Desktop. Staying up to date is your best line of defense against these types of vulnerabilities! You've got this! By updating now, you can boost your security and keep those pesky hackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01242 · 69.0th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2022-01-04T18:55Z
EPSS history
Timeline
  • 04 JAN 18:55Z
    The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp…
    cvelistv5