CVE Tools
Track your stack

Whatsapp

17 CVEs tracked since 2019. Since May 2019, 1 of them reached CISA KEV.

Whatsapp CVEs per month

May 2019 to Nov 2020. Point at a month, or focus the strip and use the arrow keys.
Whatsapp CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2019-0521
2019-06null or fewer
2019-07null or fewer
2019-08null or fewer
2019-09null or fewer
2019-10null or fewer
2019-11null or fewer
2019-12null or fewer
2020-01null or fewer
2020-02null or fewer
2020-03null or fewer
2020-04null or fewer
2020-05null or fewer
2020-06null or fewer
2020-07null or fewer
2020-08null or fewer
2020-0960
2020-1070
2020-1120

Products

The products that kept showing up in Whatsapp's monthly top three, with their CVEs summed over those months.

  1. Whatsapp154 months
  2. Whatsapp Business134 months
  3. Whatsapp Desktop21 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Whatsapp.

  1. CVE-2026-23866Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to tri...4.3
  2. CVE-2026-23863An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the...6.5
  3. CVE-2025-55179Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigge...5.4
  4. CVE-2025-55177Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allow...5.4
  5. CVE-2025-30401A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename exte...6.7
  6. CVE-2023-38538A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low proba...5.0
  7. CVE-2023-38537A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpecte...5.6
  8. CVE-2022-27492An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.7.8
  9. CVE-2022-36934An integer overflow in WhatsApp could result in remote code execution in an established video call.9.8
  10. CVE-2020-20096Whatsapp iOS 2.19.80 and prior and Android 2.19.222 and prior user interface does not properly represent URI messages to the user, which results in URI spoofing via specially crafted messages.6.5
  11. CVE-2021-24043A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230....9.1
  12. CVE-2021-24042The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, Wha...9.8
  13. CVE-2021-24041A missing bounds check in image blurring code prior to WhatsApp for Android v2.21.22.7 and WhatsApp Business for Android v2.21.22.7 could have allowed an out-of-bounds write if a user sent a malici...9.8
  14. CVE-2021-24035A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite ...9.1
  15. CVE-2021-24026A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.2...9.8

The record

Peak rank
#65 in Oct 2020
Busiest month shown
Oct 2020, 7 CVEs
Months with a KEV entry
1 since May 2019
Monthly snapshots
4 since 2019
Whatsapp's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store