CVE-2023-38538 Use after free in WhatsApp Business for Android

Medium 5.0 Published 4 Oct 2023 Updated 19 Sep 2024

A race condition in WhatsApp's event subsystem causes a heap use-after-free, potentially leading to app crashes or unexpected control flow during calls.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-38538?

CVE-2023-38538 is a medium-severity use after free vulnerability in Facebook WhatsApp Business for Android, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

Weakness: CWE-362

Which versions are affected by CVE-2023-38538?

It affects 1 product.

Products include Whatsapp Whatsapp.

How do I fix CVE-2023-38538?

No fix has been published for CVE-2023-38538 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-38538 being exploited?

There is no known exploitation of CVE-2023-38538 in the wild and no public exploit code.

Sources

Also known as GHSA-hr72-3p79-rchw.