CVE-2019-3568
Critical 9.8 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- WhatsApp VOIP Stack Buffer Overflow Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 30% (percentile: 98) as of 2 November 2026
- CWE
- CWE-122, CWE-787
Affected products
whatsapp: whatsapp; whatsapp: whatsapp business
References
- http://www.securityfocus.com/bid/108329 Broken LinkThird Party AdvisoryVDB Entry
- https://www.facebook.com/security/advisories/cve-2019-3568 Third Party Advisory
- http://www.securityfocus.com/bid/108329 Broken LinkThird Party AdvisoryVDB Entry
- https://www.facebook.com/security/advisories/cve-2019-3568 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019… US Government Resource