CVE-2025-55179

CVE-2025-55179

Medium · published November 18, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Published
2025-11-18T20:16Z
Affected products (3)
ProductVersionsFixed in
whatsapp/whatsapp≥ 2.25.8.14, < 2.25.23.832.25.23.83
whatsapp/whatsapp≥ 2.25.8.17, < 2.25.23.732.25.23.73
whatsapp/whatsapp_business≥ 2.25.8.14, < 2.25.23.822.25.23.82
References (2)
https://www.facebook.com/security/advisories/cve-2025-55179 · [email protected]https://www.whatsapp.com/security/advisories/2025/ · [email protected]
EPSS history
Timeline
  • 18 NOV 13:56Z
    Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac…
    cvelistv5