Vulnerability in Facebook Whatsapp Desktop For Windows
CVE-2026-23863
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.005 (43.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 43rd percentile — 43.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Facebook Whatsapp Desktop For Windows — versions 2.3000.*.252500
Weakness classification (CWE)
References
- www.facebook.com/security/advisories/cve-2026-23863 (Third Party Advisory)
- www.whatsapp.com/security/advisories/2026 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-23863?
- CVE-2026-23863 is a medium-severity vulnerability in Facebook Whatsapp Desktop For Windows, classified under CWE-158. CVSS score: 6.5/10. Published 2026-05-01.
- How severe is CVE-2026-23863?
- Medium severity. CVSS v3 base score is 6.5 out of 10.