CVE-2019-11931 Memory corruption in WhatsApp Business for Android

High 7.8 Published 14 Nov 2019 Updated 4 Aug 2024

Attackers can achieve remote code execution or denial of service by sending a malicious MP4 file to WhatsApp users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-11931?

CVE-2019-11931 is a high-severity memory corruption vulnerability in Facebook WhatsApp Business for Android, published on 14 Nov 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2019-11931?

It affects 3 products.

Products include Whatsapp Whatsapp, Whatsapp Whatsapp Business, Whatsapp Whatsapp Enterprise Client.

How do I fix CVE-2019-11931?

No fix has been published for CVE-2019-11931 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-11931 being exploited?

There is no known exploitation of CVE-2019-11931 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as GHSA-6c69-f792-7pq7.