Description
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WhatsApp Desktop for Mac | 2.22.25.2 – < 2.25.21.78 | 2.25.21.78 | |
| WhatsApp Business for iOS | 2.22.25.2 – < 2.25.21.78 | 2.25.21.78 | |
| WhatsApp for iOS | 2.22.25.2 – < 2.25.21.73 | 2.25.21.73 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
danielw98/zero-click-exploit-analysis ★ 7 · Apr 24, 2026
CVE-2025-55177 + CVE-2025-43300: reverse-engineering the WhatsApp-ImageIO zero-click iOS chain, with interactive labs.
-
giannicabrera90-design/iOS-WhatsApp-Zero-Click-Forensic-Scanner ★ 0 · Nov 12, 2026
iOS WhatsApp Zero-Click Forensic Scanner (CVE-2025-55177 & CVE-2025-43300)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.