CVE-2019-3568 on CISA KEV

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp fo

01What CISA says about this vulnerability

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348…

02Required action — verbatim from CISA

Apply updates per vendor instructions.

03Notes & references

• www.facebook.com — https://www.facebook.com/security/advisories/cve-2019-3568
• www.securityfocus.com — http://www.securityfocus.com/bid/108329

04SARA's analyst layer — why this matters

This vulnerability is currently on the CISA KEV list, which CISA only adds CVEs to when there is reliable evidence of active exploitation in the wild. For federal civilian agencies, BOD 22-01 requires remediation by the due date above. For everyone else, KEV is the strongest "patch immediately" signal you can get from public threat intel.

05Affected products (summary)

Vendor	Product	Versions
Facebook	WhatsApp for Android	2.19.134, unspecified
Facebook	WhatsApp Business for Android	2.19.44, unspecified
Facebook	WhatsApp for iOS	2.19.51, unspecified
Facebook	WhatsApp Business for iOS	2.19.51, unspecified
Facebook	WhatsApp for Windows Phone	2.18.348, unspecified
Facebook	WhatsApp for Tizen	2.18.15, unspecified

06Detection

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection:

Open in Sigma generator →