CVE-2019-3568VulnerabilityPublished 04/19/2022Updated 10/24/2026

CVE-2019-3568: WhatsApp VOIP Stack Buffer Overflow Vulnerability

Affects Meta Platforms WhatsAppSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/19/2022
KEV deadline: 05/10/2022
EPSS: 30.1% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2019-3568 (opens in a new tab)

Description

CVE-2019-3568 is a buffer overflow vulnerability in the WhatsApp VOIP stack that allows remote code execution when a specially crafted series of RTCP packets are sent to a target phone number. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Summary

This vulnerability involves a buffer overflow in the WhatsApp VOIP stack, which can be triggered remotely by sending a crafted sequence of RTCP packets to a victim's phone number. Successful exploitation can lead to remote code execution on the target device. The vulnerability is tracked as CVE-2019-3568 and is associated with CWE-122 (Heap-based Buffer Overflow). It has been confirmed to be exploited in the wild. No vendor advisory or patch details are provided in the input data.

Impact

Exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected device via the WhatsApp VOIP stack. This can lead to full compromise of the target device. The vulnerability has been actively exploited in the wild, indicating a significant real-world threat.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor official Meta Platforms advisories for updates and apply any released patches promptly.

Weaknesses

CWE-122Heap-based Buffer Overflow (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:27:09 UTC

Weaknesses

References

Related threats