This vulnerability (CWE-158) affects WhatsApp Desktop for Windows versions before 2.3000.1032164386.258709. It arises from improper handling of embedded NUL bytes in attachment filenames, enabling an attacker to spoof file types. Specifically, a malicious document could be displayed as a benign file type but execute as an executable upon opening. The CVSS 3.1 base score is 6.5, reflecting medium severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, no availability impact, and functional exploit code known. The vendor has issued an official fix to address this vulnerability.

Successful exploitation could allow an attacker to trick users into executing malicious code by disguising executable files as benign documents. This impacts the integrity of the system by potentially running unauthorized code. There is no impact on confidentiality or availability reported. No active exploitation has been observed in the wild.

An official fix is available and should be applied by updating WhatsApp Desktop for Windows to version 2.3000.1032164386.258709 or later. Users should ensure they are running the patched version to mitigate this vulnerability. Since the vendor has provided an official fix, applying this update is the recommended remediation.