CVE-2018-6350

9.8 criticalEPSS 1.7%

An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-125
Published: 2019-06-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

whatsapp:whatsapp
whatsapp:whatsapp_business

References

http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/
http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/

Check your stack JSON