Read the docs
TI-2023-19918 Aliases CVE-2023-38538GHSA-hr72-3p79-rchw

Race condition in Meta WhatsApp Desktop for Mac

Priority LOW 22CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed WhatsApp Desktop for Mac (Facebook): 2.2338.12WhatsApp Desktop for Windows (Facebook): 2.2320.2+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaWhatsApp Desktop for Macbefore 2.2338.122.2338.12Patch availableCNA
MetaWhatsApp Desktop for Windowsbefore 2.2320.22.2320.2Patch availableCNA
MetaWhatsApp Business for iOSbefore 2.23.10.772.23.10.77Patch availableCNA
MetaWhatsApp for iOSbefore 2.23.10.772.23.10.77Patch availableCNA
MetaWhatsApp Business for Androidbefore 2.23.10.772.23.10.77Patch availableCNA
MetaWhatsApp for Androidbefore 2.23.10.772.23.10.77Patch availableCNA
  • WhatsApp Desktop for Mac VendorMeta Affected before 2.2338.12 Fixed in 2.2338.12 Patch available CNA
  • WhatsApp Desktop for Windows VendorMeta Affected before 2.2320.2 Fixed in 2.2320.2 Patch available CNA
  • WhatsApp Business for iOS VendorMeta Affected before 2.23.10.77 Fixed in 2.23.10.77 Patch available CNA
  • WhatsApp for iOS VendorMeta Affected before 2.23.10.77 Fixed in 2.23.10.77 Patch available CNA
  • WhatsApp Business for Android VendorMeta Affected before 2.23.10.77 Fixed in 2.23.10.77 Patch available CNA
  • WhatsApp for Android VendorMeta Affected before 2.23.10.77 Fixed in 2.23.10.77 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:windows:*:*before 2.2320.2VulnerableWhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:desktop:windows:*:* Versions before 2.2320.2 Vulnerable ·WhatsApp

Remediation

  • Fix · CNA WhatsApp Desktop for Mac (Facebook) Fixed in 2.2338.12
  • Fix · CNA WhatsApp Desktop for Windows (Facebook) Fixed in 2.2320.2
  • Fix · CNA WhatsApp Business for iOS (Facebook) Fixed in 2.23.10.77
  • Fix · CNA WhatsApp for iOS (Facebook) Fixed in 2.23.10.77
  • Fix · CNA WhatsApp Business for Android (Facebook) Fixed in 2.23.10.77
  • Fix · CNA WhatsApp for Android (Facebook) Fixed in 2.23.10.77

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Facebook WhatsApp Business for Android, WhatsApp Business for iOS and 4 more products 2.23.10.77, 2.2320.2, 2.2338.12

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-19917 Race condition in Meta WhatsApp Desktop for MacPriority LOW 25
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-38538
  2. 2026-10-03 Alias added: GHSA-hr72-3p79-rchw

References

Advisory 1

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences