VulnerabilityModified

CVE-2018-6350

An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers.

CRITICAL 9.8EPSS 1.69%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.69% probability · 76th percentile
CISA KEV: Not listed
Weakness: CWE-125
Affected: whatsapp/whatsapp · whatsapp/whatsapp business
Source: cve-assign@fb.com

References

http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/Third Party Advisory
http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.