CVE-2025-30259 Security feature bypass in WhatsApp cloud service
Attackers can bypass sandbox protections via crafted PDFs to install Android malware and gain remote access to messaging applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-30259?
CVE-2025-30259 is a low-severity vulnerability in Meta WhatsApp cloud service, published on 19 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow remote access to messaging applications by third parties, as exploited in the wild in 2024 for installation of Android malware associated with BIGPRETZEL.
Which versions are affected by CVE-2025-30259?
How do I fix CVE-2025-30259?
No fix has been published for CVE-2025-30259 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-30259 being exploited?
There is no known exploitation of CVE-2025-30259 in the wild and no public exploit code.
Sources
Also known as GHSA-7cjf-7m5h-q946.