Vulnerabilities

TI-2025-12320 CVE-2025-13476 · GHSA-7qg4-wvfj-q8vh

Rakuten Viber uses broken or risky cryptographic Algorithm

MEDIUM 49

Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00368 Published 2026-03-05 Fixed in 27.2.0.0g, v27.3.0.0 CWE-327

TI-2025-35211 CVE-2025-55996 · GHSA-mr84-m23m-f429

Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface

MEDIUM 61

Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.00191 Published 2025-09-12 No fix listed CWE-79

TI-2020-11005 CVE-2020-14049 · GHSA-r3v6-qx45-r3j8

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler.

LOW 37

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02216 Published 2020-06-22 No fix listed CWE-88

TI-2018-02955 CVE-2018-3987 · GHSA-vxjc-fx83-gm4p

Information disclosure in Rakuten Viber

LOW 25

An exploitable information disclosure vulnerability exists in the 'Secret Chats' functionality of Rakuten Viber on Android 9.3.0.6.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00376 Published 2020-02-12 No fix listed CWE-200

TI-2019-13537 CVE-2019-18800 · GHSA-h624-wrj8-hr3r

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet…

MEDIUM 41

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01662 Published 2019-11-06 No fix listed CWE-311

TI-2019-09383 CVE-2019-12569 · GHSA-gp9r-j3mw-3g9f

A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to…

MEDIUM 50

A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.15041 Published 2019-06-03 No fix listed CWE-426

Vulnerabilities

Filters

Rakuten Viber uses broken or risky cryptographic Algorithm

Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface

Viber for Windows up to 13.2.0.39 does not properly quote its custom URI handler.

Information disclosure in Rakuten Viber

Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet…

A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to…