CVE-2026-23866

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23866", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "state": "PUBLISHED", "assignerShortName": "Meta", "dateReserved": "2026-01-16T19:49:26.309Z", "datePublished": "2026-05-01T16:02:03.304Z", "dateUpdated": "2026-05-01T17:42:09.286Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WhatsApp for Android", "vendor": "Facebook", "versions": [{"lessThan": "2.26.7.10", "status": "affected", "version": "2.25.8.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WhatsApp for iOS", "vendor": "Facebook", "versions": [{"lessThan": "2.26.15.72", "status": "affected", "version": "2.25.8.0", "versionType": "semver"}]}], "dateAssigned": "2026-04-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user\u2019s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild."}], "problemTypes": [{"descriptions": [{"description": "Improper Verification of Source of a Communication Channel (CWE-940)", "lang": "en"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-05-01T16:10:25.306Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.facebook.com/security/advisories/cve-2026-23866"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.whatsapp.com/security/advisories/2026"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-940", "lang": "en", "description": "CWE-940 Improper Verification of Source of a Communication Channel"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-01T17:41:43.060585Z", "id": "CVE-2026-23866", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T17:42:09.286Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-01T17:41:43.060585Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-940", "description": "CWE-940 Improper Verification of Source of a Communication Channel"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-01T17:42:01.834Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Facebook", "product": "WhatsApp for Android", "versions": [{"status": "affected", "version": "2.25.8.0", "lessThan": "2.26.7.10", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Facebook", "product": "WhatsApp for iOS", "versions": [{"status": "affected", "version": "2.25.8.0", "lessThan": "2.26.15.72", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.facebook.com/security/advisories/cve-2026-23866", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://www.whatsapp.com/security/advisories/2026", "tags": ["x_refsource_CONFIRM"]}], "dateAssigned": "2026-04-20T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user\u2019s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Verification of Source of a Communication Channel (CWE-940)"}]}], "providerMetadata": {"orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "Meta", "dateUpdated": "2026-05-01T16:10:25.306Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23866", "state": "PUBLISHED", "dateUpdated": "2026-05-01T17:42:09.286Z", "dateReserved": "2026-01-16T19:49:26.309Z", "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "datePublished": "2026-05-01T16:02:03.304Z", "assignerShortName": "Meta"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WhatsApp for Android", "vendor": "Facebook", "versions": [{"lessThan": "2.26.7.10", "status": "affected", "version": "2.25.8.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "WhatsApp for iOS", "vendor": "Facebook", "versions": [{"lessThan": "2.26.15.72", "status": "affected", "version": "2.25.8.0", "versionType": "semver"}]}], "source": "cve-assign@fb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*", "matchCriteriaId": "A9F5775D-2CBD-427C-94CD-D01C11559B06", "versionEndIncluding": "2.26.7.10", "versionStartIncluding": "2.25.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "9C83C05F-A88D-48B7-8DE8-5B8CBD9FC6B9", "versionEndIncluding": "2.26.15.72", "versionStartIncluding": "2.25.8.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user\u2019s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild."}, {"lang": "es", "value": "Validaci\u00f3n incompleta de mensajes de respuesta enriquecidos de IA para Instagram Reels en WhatsApp para iOS v2.25.8.0 a v2.26.15.72 y WhatsApp para Android v2.25.8.0 a v2.26.7.10 podr\u00eda haber permitido a un usuario activar el procesamiento de contenido multimedia desde una URL arbitraria en el dispositivo de otro usuario, incluyendo la activaci\u00f3n de manejadores de esquemas de URL personalizados controlados por el SO. No hemos visto evidencia de explotaci\u00f3n en la naturaleza."}], "id": "CVE-2026-23866", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve-assign@fb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23866", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-01T17:41:43.060585Z", "version": "2.0.3"}}]}, "published": "2026-05-01T16:16:29.980", "references": [{"source": "cve-assign@fb.com", "tags": ["Third Party Advisory"], "url": "https://www.facebook.com/security/advisories/cve-2026-23866"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://www.whatsapp.com/security/advisories/2026"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-940"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.25.8.0,2.26.7.10)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WhatsApp for Android", "source": "cna", "vendor": "Facebook"}, "product": "whatsapp_for_android", "vendor": "whatsapp"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.25.8.0,2.26.15.72)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "WhatsApp for iOS", "source": "cna", "vendor": "Facebook"}, "product": "whatsapp_for_ios", "vendor": "whatsapp"}], "created": "2026-05-02T11:45:41.771970+00:00", "title": "Unvalidated Media URL Processing Via WhatsApp AI Rich Response Messages", "updated": "2026-05-04T16:07:30.463790+00:00", "vendors": ["whatsapp", "whatsapp$PRODUCT$whatsapp_for_android", "whatsapp$PRODUCT$whatsapp_for_ios"]}