Summary
Meta Platforms WhatsApp contains an incorrect authorization vulnerability due to an incomplete authorization of linked device synchronization messages. This vulnerability could allow an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.
- Vendor
- Meta Platforms
- Product
- Added to KEV
- Sep 2, 2025
- Remediation due
- Sep 23, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-863
- EPSS
- 13.5% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References