VIR Vulnerability Intelligence Relay

CVE-2026-23863

medium
Published 2026-05-01 · Modified 2026-05-11
CVSS v3
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v2
—
VIR risk
6.5

Description

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.

Predictions

Exploit likelihood
75%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve-assign@fb.com — https://www.whatsapp.com/security/advisories/2026

Application impact
VendorProductVersionsFixed
whatsappwhatsapp{"endExcluding":"2.3000.1032164386.258709"}2.3000.1032164386.258709

References

CWEs

CWE-158

Verify integrity in audit chain (admin only). AS-IS.