CVE-2018-6344

State: Published
Severity: 7.5 High
Published: Dec 31, 2018
Updated: May 6, 2025
Reserved: Jan 26, 2018

Description

A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of service. It affects WhatsApp for Android prior to v2.18.293, WhatsApp for iOS prior to v2.18.93, and WhatsApp for Windows Phone prior to v2.18.172.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-122 Heap-based Buffer Overflow (CWE-122)

Affected Products

Product	Versions
WhatsApp for AndroidFacebook	2.18.293Affected before 2.18.293Affected
WhatsApp for iOSFacebook	2.18.93Affected before 2.18.93Affected
WhatsApp for Windows PhoneFacebook	2.18.172Affected before 2.18.172Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.