CVE-2021-24042

State: Published
Severity: 9.8 Critical
Published: Jan 4, 2022
Updated: May 22, 2025
Reserved: Jan 13, 2021

Description

The calling logic for WhatsApp for Android prior to v2.21.23, WhatsApp Business for Android prior to v2.21.23, WhatsApp for iOS prior to v2.21.230, WhatsApp Business for iOS prior to v2.21.230, WhatsApp for KaiOS prior to v2.2143, WhatsApp Desktop prior to v2.2146 could have allowed an out-of-bounds write if a user makes a 1:1 call to a malicious actor.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-122 Heap-based Buffer Overflow (CWE-122)
CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
WhatsApp DesktopFacebook	before v2.2146Affected v2.2146 to before unspecifiedNot affected
WhatsApp for KaiOSFacebook	before v2.2143Affected v2.2143 to before unspecifiedNot affected
WhatsApp Business for iOSFacebook	before v2.21.230Affected v2.21.230 to before unspecifiedNot affected
WhatsApp for iOSFacebook	before v2.21.230Affected v2.21.230 to before unspecifiedNot affected
WhatsApp Business for AndroidFacebook	before v2.21.23Affected v2.21.23 to before unspecifiedNot affected
WhatsApp for AndroidFacebook	before v2.21.23Affected v2.21.23 to before unspecifiedNot affected

References

https://www.whatsapp.com/security/advisories/2021/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.