Out-of-bounds Read in Facebook Whatsapp Business For Android
CVE-2018-6350
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.017 (76.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 76.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.017 · change: +0.002
Affected products
- Facebook Whatsapp Business For Android — versions 2.18.99, unspecified
- Facebook Whatsapp Business For iOS — versions 2.18.100.2, unspecified
- Facebook Whatsapp For Android — versions 2.18.276, unspecified
- Facebook Whatsapp For iOS — versions 2.18.100.6, unspecified
- Facebook Whatsapp For Windows Phone — versions 2.18.224, unspecified
- Whatsapp Business
Weakness classification (CWE)
References
- www.facebook.com/security/advisories/cve-2018-6350/ (Third Party Advisory)
- www.securityfocus.com/bid/108803 (vdb-entry)
Frequently asked questions
- What is CVE-2018-6350?
- CVE-2018-6350 is a critical-severity vulnerability in Facebook Whatsapp Business For Android, classified under Out-of-bounds Read. CVSS score: 9.8/10. Published 2019-06-14.
- How severe is CVE-2018-6350?
- Critical severity. CVSS v3 base score is 9.8 out of 10.