Read the docs
TI-2019-12800 Aliases CVE-2019-17151GHSA-92mc-7g43-2wj6

Open redirect in Tencent WeChat

Priority LOW 27CWE-356Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-601.

Summary

This vulnerability allows remote attackers redirect users to an external resource on affected installations of Tencent WeChat Prior to 7.0.9. User interaction is required to exploit this vulnerability in that the target must be within a chat session together with the attacker. The specific flaw exists within the parsing of a users profile. The issue lies in the failure to properly validate a users name. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9302.

Why it matters now

EPSS 0.01374 72nd percentileScored 2026-11-07
Fix Fixed WeChat (Tencent): 7.0.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TencentWeChatbefore 7.0.97.0.9Patch availableCNA
  • WeChat VendorTencent Affected before 7.0.9 Fixed in 7.0.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tencent:wechat:*:*:*:*:*:android:*:*before 7.0.9VulnerableTencent
  • cpe:2.3:a:tencent:wechat:*:*:*:*:*:android:*:* Versions before 7.0.9 Vulnerable ·Tencent

Remediation

  • Fix · CNA WeChat (Tencent) Fixed in 7.0.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17151
  2. 2026-10-03 Alias added: GHSA-92mc-7g43-2wj6

References

Advisory 1

  • TI-2024-26921 Insecure Permissions vulnerability in Tencent wechat v.8.0.37 allows an attacker to… CVSS 3.1HIGH 8.8
  • TI-2020-16942 Memory corruption in Tencent WeChat CVSS 3.1HIGH 8.8
  • TI-2021-08787 Out-of-bounds read in Tencent WeChat CVSS 3.1MEDIUM 6.5
  • TI-2021-17359 In the WeChat application 8.0.10 for Android and iOS, a mini program can obtain sensitive… CVSS 3.1HIGH 7.5
  • TI-2019-08535 vcodec2_hls_filter in libvoipCodec_v7a.so in the WeChat application through 7.0.3 for… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences