CVE-2025-55177
Description
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
How to fix
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Sep 23, 2025- whatsapp whatsapp2.25.21.73, 2.25.21.78 or later
- whatsapp whatsapp_business2.25.21.78 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| whatsapp whatsapp | 2.22.25.2 ≤ v < 2.25.21.73, 2.22.25.2 ≤ v < 2.25.21.78 | 2.25.21.73, 2.25.21.78 |
| whatsapp whatsapp_business | 2.22.25.2 ≤ v < 2.25.21.78 | 2.25.21.78 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.