by Kastro
Paper/Archive/CVE-2021-24043

CVE-2021-24043

facebook — A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, Whats…

EPSS 1%CVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 65.3.653 × 2013.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refwhatsapp.com/security/advisories/2021