CVE-2026-23863
- State
- Published
- Severity
- 6.5 Medium
- Published
- May 1, 2026
- Updated
- May 1, 2026
- Reserved
- Jan 16, 2026
Description
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C | Meta |
Weaknesses
- CWE-158 Improper Neutralization of Null Byte or NUL Character
Affected Products
| Product | Versions |
|---|---|
WhatsApp Desktop for WindowsFacebook |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.