CVE-2019-3568

9.8 criticalKEVEPSS 30%

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2022-04-19, due 2022-05-10
CWEs: CWE-787, CWE-122
Published: 2019-05-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

whatsapp:whatsapp
whatsapp:whatsapp_business

References

http://www.securityfocus.com/bid/108329
https://www.facebook.com/security/advisories/cve-2019-3568
http://www.securityfocus.com/bid/108329
https://www.facebook.com/security/advisories/cve-2019-3568
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568

Check your stack JSON