Description
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WhatsApp Business for iOS | 2.25.8.14 – < 2.25.23.82 | 2.25.23.82 | |
| WhatsApp for iOS | 2.25.8.17 – < 2.25.23.73 | 2.25.23.73 | |
| WhatsApp Desktop for Mac | 2.25.8.14 – < 2.25.23.83 | 2.25.23.83 |
Advisories 1
- WID-SEC-2025-2634 Meta WhatsApp: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 18, 2025