Description
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WhatsApp for Android | 2.19.274, unspecified – < 2.19.274 | 2.19.274 | |
| WhatsApp for iOS | 2.19.100, unspecified – < 2.19.100 | 2.19.100 | |
| WhatsApp for Windows Phone | unspecified – ≤ 2.18.368 | — | |
| WhatsApp Enterprise Client | 2.25.3, unspecified – < 2.25.3 | 2.25.3 | |
| WhatsApp Business for Android | 2.19.104, unspecified – < 2.19.104 | 2.19.104 | |
| WhatsApp Business for iOS | 2.19.100, unspecified – < 2.19.100 | 2.19.100 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
kasif-dekel/whatsapp-rce-patched ★ 36 · Nov 16, 2019
cve-2019-11931
-
nop-team/CVE-2019-11931 ★ 0 · Nov 23, 2019
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.