CVE-2025-55179 — Whatsapp Business FOR IOS vulnerability

3 documents3 sources
Severity
5.4MEDIUMNVD
EPSS
0.0%
top 92.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Facebook Whatsapp Business FOR IOSFacebook Whatsapp Desktop FOR MACFacebook Whatsapp FOR IOS+2 more
Timeline
PublishedNov 18

Description

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages5 packages

▶NVDwhatsapp/whatsapp_business2.25.8.14 — 2.25.23.82
▶CVEListV5facebook/whatsapp_business_for_ios2.25.8.14 — 2.25.23.82
▶NVDwhatsapp/whatsapp2.25.8.14 — 2.25.23.83+1
▶CVEListV5facebook/whatsapp_for_ios2.25.8.17 — 2.25.23.73
▶CVEListV5facebook/whatsapp_desktop_for_mac2.25.8.14 — 2.25.23.83

🔴Vulnerability Details

2
CVEList
CVE-2025-55179: Incomplete validation of rich response messages in WhatsApp for iOS prior to v2↗2025-11-18
▶
GHSA
GHSA-qfr3-q6jf-3gx8: Incomplete validation of rich response messages in WhatsApp for iOS prior to v2↗2025-11-18
▶
CVE-2025-55179 — MEDIUM severity | cvebase