CVE-2025-30401
Medium
Description
A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild.
SeverityMedium
CVSS6.7
Exploit probability—
ProductWhatsapp
PublishedApr 5, 2025
First seenApr 5, 2025
Weakness typeCWE-430CWE-430
How to fix
Update
- whatsapp whatsapp2.2450.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| whatsapp whatsapp | v < 2.2450.6 | 2.2450.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.