CVE-2020-1907

9.8 criticalEPSS 1.9%

Critical (9.8) in whatsapp. EPSS 1.9% chance of exploitation in the next 30 days.

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-787
Published: 2020-10-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

whatsapp:whatsapp
whatsapp:whatsapp_business

References

https://www.whatsapp.com/security/advisories/2020/
https://www.whatsapp.com/security/advisories/2020/

Check your stack JSON