CVE-2021-24043
Critical
Description
A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.
SeverityCritical
CVSS9.1
Exploit probability—
ProductWhatsapp
PublishedFeb 2, 2022
First seenFeb 2, 2022
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| whatsapp whatsapp | 2.21.23.2, 2.21.230.6, 2.2145.0 | — |
| whatsapp whatsapp_business | 2.21.23.2, 2.21.230.7 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.