WhatsApp VOIP Stack Buffer Overflow Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 14, 2019 · Catalog

   Detected

   A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and

2. Apr 19, 2022 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 10, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and

Affected

• cpe whatsapp/whatsappversion unspecified
• cpe whatsapp/whatsapp businessversion unspecified
• vendor Meta Platforms WhatsAppversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2019-3568

  A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.

  cisa.gov
• CVE.orgVulnerability recordCVE-2019-3568

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2019-3568

  30-day exploitation probability 30.1%

  first.org
• NIST NVDVulnerability recordCVE-2019-3568

  A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp fo

  nvd.nist.gov

References

• Broken Link · securityfocus.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Third Party Advisory · facebook.com