CVE-2019-3568

Published May 14, 2019 CVSS 3.1 · 9.8 Critical EPSS 30.1% KEV · Listed
Description
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Whatsapp whatsapp Business
CPEs cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:business:android:*:*
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:business:iphone_os:*:*
cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:android:*:*
cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*
Vendors & Products Whatsapp whatsapp Business
Type Values Removed Values Added
Metrics epss

{'score': 0.33311}

epss

{'score': 0.36028}

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2022-04-19'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Weaknesses CWE-119 CWE-787
Weaknesses

Sources

Status
PUBLISHED
Assigner
facebook
Published
Updated
Oct 21, 2025, 11:45 PM
Reserved
Jan 2, 2019, 12:00 AM
Status
Analyzed
Published
May 14, 2019, 8:29 PM
Modified
Jun 17, 2026, 2:35 AM