CVE-2020-1907

published 2020-10-06

CVE-2020-1907: A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90…

Priority P3 54 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

A stack overflow in WhatsApp for Android prior to v2.20.196.16, WhatsApp Business for Android prior to v2.20.196.12, WhatsApp for iOS prior to v2.20.90, WhatsApp Business for iOS prior to v2.20.90, and WhatsApp for Portal prior to v173.0.0.29.505 could have allowed arbitrary code execution when parsing the contents of an RTP Extension header.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
facebook	whatsapp_business_for_android	—	—
facebook	whatsapp_business_for_android	>= unspecified < 2.20.196.12	2.20.196.12
facebook	whatsapp_business_for_ios	—	—
facebook	whatsapp_business_for_ios	>= unspecified < 2.20.90	2.20.90
facebook	whatsapp_for_android	—	—
facebook	whatsapp_for_android	>= unspecified < 2.20.196.16	2.20.196.16
facebook	whatsapp_for_ios	—	—
facebook	whatsapp_for_ios	>= unspecified < 2.20.90	2.20.90
facebook	whatsapp_for_portal	—	—
facebook	whatsapp_for_portal	>= unspecified < 173.0.0.29.505	173.0.0.29.505
whatsapp	whatsapp	< 2.20.90	2.20.90
whatsapp	whatsapp	< 2.20.196.16	2.20.196.16
whatsapp	whatsapp	< 173.0.0.29.505	173.0.0.29.505
whatsapp	whatsapp_business	< 2.20.90	2.20.90
whatsapp	whatsapp_business	< 2.20.196.12	2.20.196.12

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787