by Kastro
Paper/Archive/CVE-2021-24026

CVE-2021-24026

Facebook WhatsApp Business for iOS — A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business…

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.5.725 × 2014.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write.

Affected

ProductAffectedFixed inSource
WhatsApp Business for iOSunspecified – < v2.21.32v2.21.32CNA
WhatsApp for iOSunspecified – < v2.21.32v2.21.32CNA
WhatsApp Business for Androidunspecified – < v2.21.3v2.21.3CNA
WhatsApp for Androidunspecified – < v2.21.3v2.21.3CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwhatsapp.com/security/advisories/2021