Read the docs
TI-2026-19224 Aliases CVE-2026-23863GHSA-75gp-7gp7-rqpf

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709…

Priority LOW 29CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Fixed WhatsApp Desktop for Windows (Facebook): 2.3000.1032164386.258709

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MetaWhatsApp Desktop for Windowsbefore 2.3000.1032164386.2587092.3000.1032164386.258709Patch availableCNA
  • WhatsApp Desktop for Windows VendorMeta Affected before 2.3000.1032164386.258709 Fixed in 2.3000.1032164386.258709 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:windows:*:*before 2.3000.1032164386.258709VulnerableWhatsApp
  • cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:windows:*:* Versions before 2.3000.1032164386.258709 Vulnerable ·WhatsApp

Remediation

  • Fix · CNA WhatsApp Desktop for Windows (Facebook) Fixed in 2.3000.1032164386.258709

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23863
  2. 2026-10-03 Alias added: GHSA-75gp-7gp7-rqpf

References

Advisory 2

  • TI-2025-34861 Deserialization of untrusted data in Meta react-server-dom-webpack KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-02633 Heap-based buffer overflow in Meta WhatsApp for Android KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-13416 Cross-site scripting in Meta WhatsApp Desktop KEVCVSS 3.1HIGH 8.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2025-34857 Incorrect authorization in Meta WhatsApp Desktop for Mac KEVCVSS 3.1MEDIUM 5.4
  • TI-2025-34863 Deserialization of untrusted data in Meta react-server-dom-webpack CVSS 3.1HIGH 7.5
See all 191 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences