9.8crit
CVE-2018-6350
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 77%
Public exploits
0
none known
Summary
An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.
Exploit prediction (EPSS)
1.69% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Facebook WhatsApp for Android
- Facebook WhatsApp Business for Android
- Facebook WhatsApp for iOS
- Facebook WhatsApp Business for iOS
- Facebook WhatsApp for Windows Phone
Classification
- Weakness
- CWE-125 Out-of-bounds Read
References
- facebook.com /security/advisories/cve-2018-6350/ · x_refsource_MISC, x_transferred
- securityfocus.com /bid/108803 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-6350
- NVD: CVE-2018-6350
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.