CVE-2022-36934CWE-122

An integer overflow in WhatsApp could result in remote code execution in an established video call

Critical · published September 22, 2022

CVSS v3.1
9.8
EPSS
2%
Percentile
84.3
In the wild
Unconfirmed
What it is

🚨 An integer overflow in WhatsApp during video calls could be a techie’s worst nightmare! Imagine a simple chat turning into a complete takeover. 🔥 Think of it like a sneaky waiter at a restaurant who overhears your order and switches it out for something totally unexpected—only in this case, it's not just your meal; it's your whole device coming under attack! An attacker could exploit this overflow to execute arbitrary code during an established video call, potentially taking control of the target device. This could lead to unauthorized access to personal data, manipulation of settings, or even activating the mic and camera without the user’s knowledge—absolutely devastating!

Put simply

Think of it like a sneaky waiter at a restaurant who overhears your order and switches it out for something totally unexpected—only in this case, it's not just your meal; it's your whole device coming under attack! The vulnerability arises from an integer overflow that allows an attacker to manipulate memory allocations, effectively executing remote code during a video call without any authentication required.

What to do

An attacker could exploit this overflow to execute arbitrary code during an established video call, potentially taking control of the target device. This could lead to unauthorized access to personal data, manipulation of settings, or even activating the mic and camera without the user’s knowledge—absolutely devastating! Patch your WhatsApp to the latest version immediately to mitigate this risk. Ensure that your devices are protected with up-to-date software—no one likes surprises during a video chat! You've got this! Stay vigilant and follow these steps to secure your calls. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02458 · 84.3th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2022-09-22T21:30Z
EPSS history
Timeline
  • 22 SEP 21:30Z
    An integer overflow in WhatsApp could result in remote code execution in an established video call
    cvelistv5