CVE-2026-23863

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-26)

CWE

CWE-158

Published

2026-05-01

Modified

2026-10-26

Record from

the NVD, synced 2026-10-26

Affected

• whatsapp:whatsapp

References

• https://www.facebook.com/security/advisories/cve-2026-23863
• https://www.whatsapp.com/security/advisories/2026

Check your stackJSON