CVE-2019-3568

State: Published
Severity: 9.8 Critical
Published: May 14, 2019
Updated: Oct 21, 2025
Reserved: Jan 2, 2019

Description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-122 Heap-based Buffer Overflow (CWE-122)

Affected Products

Product	Versions
WhatsApp for AndroidFacebook	2.19.134Affected before 2.19.134Affected
WhatsApp Business for AndroidFacebook	2.19.44Affected before 2.19.134Affected
WhatsApp for iOSFacebook	2.19.51Affected before 2.19.51Affected
WhatsApp Business for iOSFacebook	2.19.51Affected before 2.19.51Affected
WhatsApp for Windows PhoneFacebook	2.18.348Affected before 2.18.348Affected
WhatsApp for TizenFacebook	2.18.15Affected before 2.18.15Affected

References

https://www.facebook.com/security/advisories/cve-2019-3568
108329vdb-entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.