CVE-2019-3568A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Updated under an hour ago ()
Does this affect you?
It affects Facebook WhatsApp for Android and 7 other products. Add what you run to find out whether that includes you.
CISA lists it as known exploited since Apr 19, 2022; federal agencies had to remediate by May 10, 2022. Treat that date as your deadline.
Do this next
Free account, 1 product
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
- CVSS
- 9.8 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-122
- Known exploited
- Added to CISA KEV Apr 19, 2022; federal remediation due May 10, 2022Apply updates per vendor instructions.
- EPSS (exploitation in the next 30 days)
- 30.08% (percentile 98)
- Assigned by
- NVD analysis
- Analyzed
- Record last updated
- Oct 21, 2025
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Facebook WhatsApp for Android facebook:whatsapp_for_android (from the name) | 2.19.134; from unspecified before 2.19.134 | CNA record |
Facebook WhatsApp Business for Android facebook:whatsapp_business_for_android (from the name) | 2.19.44; from unspecified before 2.19.134 | CNA record |
Facebook WhatsApp for iOS facebook:whatsapp_for_ios (from the name) | 2.19.51; from unspecified before 2.19.51 | CNA record |
Facebook WhatsApp Business for iOS facebook:whatsapp_business_for_ios (from the name) | 2.19.51; from unspecified before 2.19.51 | CNA record |
Facebook WhatsApp for Windows Phone facebook:whatsapp_for_windows_phone (from the name) | 2.18.348; from unspecified before 2.18.348 | CNA record |
Facebook WhatsApp for Tizen facebook:whatsapp_for_tizen (from the name) | 2.18.15; from unspecified before 2.18.15 | CNA record |
whatsapp whatsapp whatsapp:whatsapp | before 2.18.15; before 2.18.348; before 2.19.51; before 2.19.134 | NVD |
whatsapp whatsapp_business whatsapp:whatsapp_business | before 2.19.44; before 2.19.51 | NVD |
References
- https://www.facebook.com/security/advisories/cve-2019-3568x-refsource-misc, third-party-advisory
- http://www.securityfocus.com/bid/108329vdb-entry, x-refsource-bid, broken-link, third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568us-government-resource
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.