Background exploitation KEV catalog No authentication

CVE-2019-3568

Meta Platforms WhatsApp VOIP Stack Buffer Overflow Vulnerability

CheckOps priority index

7.2/10 Patch within 7 days

Severity9.8

Probability3.0

Exploitation4/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 30.1% higher than 98.2% of CVEs

CVSS 3.1 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:

Exploited for 1,660 days 19 Apr 2022

CISA due date 10 May 2022 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 4 / 5

KEV catalog (CISA)19 Apr 2022
Exploited in EUVD (ENISA)19 Apr 2022
Used by ransomwareno
EPSS above 10 %30.1%
No account, over the networkyes

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply updates per vendor instructions.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Affected products

WhatsApp Business for AndroidWhatsApp for TizenWhatsApp for AndroidWhatsApp Business for iOSWhatsApp for iOSWhatsApp for Windows PhoneWhatsApp

Affected versions

unspecified <2.19.134
unspecified <2.18.15
unspecified <2.19.51
unspecified <2.18.348
2.19.44
2.18.348
2.18.15
2.19.51
2.19.134

Weaknesses (CWE)

CWE-122

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

14 May 2019
Published
19 Apr 2022
Exploitation reported (ENISA)
19 Apr 2022
Added to the KEV catalog
10 May 2022
CISA remediation due date
26 Sept 2026
EPSS peak: 30.1%

References

Other exploited vulnerabilities from the same vendor

CVE-2025-55177Meta Platforms WhatsApp Incorrect Authorization Vulnerability
4.4 · Background exploitation
CVE-2019-18426WhatsApp Cross-Site Scripting Vulnerability
7.7 · Background exploitation