What is CVE-2019-3568?

CVE-2019-3568 is a critical-severity vulnerability in Facebook Whatsapp Business For Android, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2019-05-14.

How severe is CVE-2019-3568?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2019-3568 known to be exploited?

Yes. CVE-2019-3568 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-04-19), indicating it is being actively exploited. 12 public proof-of-concept repositories are indexed.

Buffer overflow in Facebook Whatsapp Business For Android

CVE-2019-3568

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Vulnerability class: Buffer Overflow

EPSS: 0.392 (98.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Facebook Whatsapp Business For Android — versions 2.19.44, unspecified
Facebook Whatsapp Business For Ios — versions 2.19.51, unspecified
Facebook Whatsapp For Android — versions 2.19.134, unspecified
Facebook Whatsapp For Ios — versions 2.19.51, unspecified
Facebook Whatsapp For Tizen — versions 2.18.15, unspecified
Facebook Whatsapp For Windows Phone — versions 2.18.348, unspecified
Whatsapp
Whatsapp Whatsapp_business

Weakness classification (CWE)

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2022-04-19. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2022-05-10.

Required action: Apply updates per vendor instructions.

Public proof-of-concept exploits

References

cve-assign@fb.com (Third Party Advisory, x_refsource_MISC)
cve-assign@fb.com (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2019-3568?: CVE-2019-3568 is a critical-severity vulnerability in Facebook Whatsapp Business For Android, classified under Heap-based Buffer Overflow. CVSS score: 9.8/10. Published 2019-05-14.
How severe is CVE-2019-3568?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2019-3568 known to be exploited?: Yes. CVE-2019-3568 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-04-19), indicating it is being actively exploited. 12 public proof-of-concept repositories are indexed.