TI-2018-04668 Aliases CVE-2018-6344 GHSA-vhw2-763j-8c4r

Heap-based buffer overflow in Meta WhatsApp for Android

MEDIUM 43CWE-122Published 2018-12-31 · Updated 2025-05-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used to cause denial of service. It affects WhatsApp for Android prior to v2.18.293, WhatsApp for iOS prior to v2.18.93, and WhatsApp for Windows Phone prior to v2.18.172.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01949 80th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed WhatsApp for Android (Facebook): 2.18.293WhatsApp for iOS (Facebook): 2.18.93+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Meta	WhatsApp for Android	2.18.293; before 2.18.293	2.18.293	Patch available	CNA
Meta	WhatsApp for iOS	2.18.93; before 2.18.93	2.18.93	Patch available	CNA
Meta	WhatsApp for Windows Phone	2.18.172; before 2.18.172	2.18.172	Patch available	CNA

WhatsApp for Android VendorMeta Affected 2.18.293; before 2.18.293 Fixed in 2.18.293 Patch available CNA
WhatsApp for iOS VendorMeta Affected 2.18.93; before 2.18.93 Fixed in 2.18.93 Patch available CNA
WhatsApp for Windows Phone VendorMeta Affected 2.18.172; before 2.18.172 Fixed in 2.18.172 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:whatsapp:whatsapp::::::iphone_os::*	before 2.18.93	Vulnerable	WhatsApp
cpe:2.3:a:whatsapp:whatsapp::::::windows_phone::*	before 2.18.172	Vulnerable	WhatsApp
cpe:2.3:a:whatsapp:whatsapp::::::android::*	before 2.18.293	Vulnerable	WhatsApp

cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* Versions before 2.18.93 Vulnerable ·WhatsApp
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:windows_phone:*:* Versions before 2.18.172 Vulnerable ·WhatsApp
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:* Versions before 2.18.293 Vulnerable ·WhatsApp

Remediation

Fix · CNA WhatsApp for Android (Facebook) Fixed in 2.18.293
Fix · CNA WhatsApp for iOS (Facebook) Fixed in 2.18.93
Fix · CNA WhatsApp for Windows Phone (Facebook) Fixed in 2.18.172

Timeline

2026-10-02 Threatist record created from CVE-2018-6344
2026-10-03 Alias added: GHSA-vhw2-763j-8c4r

References

Exploit 1

https://googleprojectzero.blogspot.com/2018/12/adventures-in-video-conferencing-part-3.html

TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5

See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences