Read the docs
TI-2022-10507 Aliases CVE-2022-27492GHSA-98r4-4f3j-q239

An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.

Priority LOW 35CWE-191Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-191 and the CVSS impact.

Summary

An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00526 44th percentileScored 2026-11-07
Fix Fixed WhatsApp Business for iOS (Meta): v2.22.15.9WhatsApp for iOS (Meta): v2.22.15.9+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaWhatsApp Business for iOSbefore v2.22.15.9v2.22.15.9Patch availableCNA
MetaWhatsApp for iOSbefore v2.22.15.9v2.22.15.9Patch availableCNA
MetaWhatsApp for Androidbefore 2.22.16.22.22.16.2Patch availableCNA
MetaWhatsApp Business for Androidbefore 2.22.16.22.22.16.2Patch availableCNA
  • WhatsApp Business for iOS VendorMeta Affected before v2.22.15.9 Fixed in v2.22.15.9 Patch available CNA
  • WhatsApp for iOS VendorMeta Affected before v2.22.15.9 Fixed in v2.22.15.9 Patch available CNA
  • WhatsApp for Android VendorMeta Affected before 2.22.16.2 Fixed in 2.22.16.2 Patch available CNA
  • WhatsApp Business for Android VendorMeta Affected before 2.22.16.2 Fixed in 2.22.16.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*before 2.22.15.9VulnerableWhatsApp
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*before 2.22.16.2VulnerableWhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* Versions before 2.22.15.9 Vulnerable ·WhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:* Versions before 2.22.16.2 Vulnerable ·WhatsApp

Remediation

  • Fix · CNA WhatsApp Business for iOS (Meta) Fixed in v2.22.15.9
  • Fix · CNA WhatsApp for iOS (Meta) Fixed in v2.22.15.9
  • Fix · CNA WhatsApp for Android (Meta) Fixed in 2.22.16.2
  • Fix · CNA WhatsApp Business for Android (Meta) Fixed in 2.22.16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-27492
  2. 2026-10-03 Alias added: GHSA-98r4-4f3j-q239

References

Advisory 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences