CVE-2019-3568 WhatsApp VOIP Stack Buffer Overflow

Exploited in the wild Critical 9.8 Published 14 May 2019 Updated 21 Oct 2025

Remote attackers can execute arbitrary code on WhatsApp users' devices by sending specially crafted RTCP packets to their phone numbers.

Exploited in the wild: Since 19 Apr 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-3568?

CVE-2019-3568 is a critical memory corruption vulnerability in Facebook WhatsApp Business for Android, published on 14 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Weakness: CWE-787, CWE-122

Which versions are affected by CVE-2019-3568?

It affects 2 products.

Products include Whatsapp Whatsapp, Whatsapp Whatsapp Business.

How do I fix CVE-2019-3568?

No fix has been published for CVE-2019-3568 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 May 2022.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-3568 being exploited?

Yes. Attackers have exploited CVE-2019-3568 in the wild since at least 19 Apr 2022.

Sources

Also known as GHSA-cmw5-mmg8-r4fr.