Buffer overflow in Facebook Whatsapp Business For Android
CVE-2019-11931
A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This…
Vulnerability class: Buffer Overflow
EPSS: 0.013 (67.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Facebook Whatsapp Business For Android — versions 2.19.104, unspecified
- Facebook Whatsapp Business For Ios — versions 2.19.100, unspecified
- Facebook Whatsapp Enterprise Client — versions 2.25.3, unspecified
- Facebook Whatsapp For Android — versions 2.19.274, unspecified
- Facebook Whatsapp For Ios — versions 2.19.100, unspecified
- Facebook Whatsapp For Windows Phone — versions unspecified
- Whatsapp Whatsapp_business
- Whatsapp Whatsapp_enterprise_client
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve-assign@fb.com (x_refsource_CONFIRM, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-11931?
- CVE-2019-11931 is a high-severity vulnerability in Facebook Whatsapp Business For Android, classified under Stack-based Buffer Overflow. CVSS score: 7.8/10. Published 2019-11-14.
- How severe is CVE-2019-11931?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-11931 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.