CVE-2019-3568
WhatsApp VOIP Stack Buffer Overflow Vulnerability
Description
CVE-2019-3568 is a buffer overflow vulnerability in the WhatsApp VOIP stack that allowed remote code execution via a specially crafted series of RTCP packets sent to a target phone number. This critical security flaw in Meta Platforms' WhatsApp messaging application could be exploited without any interaction from the victim, as the malicious packets were delivered through the voice calling functionality. The WhatsApp buffer overflow vulnerability was notably used to deploy sophisticated surveillance spyware against targeted individuals. CISA has added CVE-2019-3568 to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022, and the EPSS percentile of approximately 97% indicates very high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| < 2.18.15; < 2.18.348; < 2.19.51; < 2.19.134 | ||
| whatsapp business | < 2.19.44; < 2.19.51 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/108329(Broken Link, Third Party Advisory, VDB Entry)
- https://www.facebook.com/security/advisories/cve-2019-3568(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568(US Government Resource)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input (Buffer Overflow)
The buffer overflow vulnerability in WhatsApp's VOIP stack occurs when the application processes incoming RTCP packets without properly validating the size of the input data. In CVE-2019-3568, specially crafted RTCP packets cause the WhatsApp application to write data beyond the boundaries of an allocated buffer, corrupting adjacent memory and enabling an attacker to execute arbitrary code on the target device.
Learn more: CWE-120 — Buffer Copy without Checking Size of Input (Classic Buffer Overflow)
Impact Analysis
CVE-2019-3568 is remotely exploitable over the network by sending specially crafted RTCP packets to a target's WhatsApp phone number, requiring no authentication and, critically, no user interaction whatsoever. The victim does not need to answer the call or take any action for the exploit to succeed, making this a true zero-click vulnerability. Successful exploitation grants the attacker remote code execution on the target mobile device, compromising the confidentiality of all data on the device including messages, photos, contacts, location data, and microphone/camera access. The integrity of the device is fully compromised as the attacker can install persistent surveillance software, and the availability of the device's legitimate functions may be disrupted. The EPSS percentile of approximately 97% indicates very high exploitation activity, and the vulnerability's association with targeted surveillance operations against journalists, activists, and government officials demonstrates its critical real-world impact.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-3568 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022. The EPSS percentile of approximately 97% indicates very high exploitation activity. This WhatsApp vulnerability gained significant attention when it was revealed to have been used for deploying surveillance spyware through zero-click exploitation, meaning the target needed only to receive a WhatsApp call to be compromised, without even answering it. The sophistication of the exploit and its use in targeted surveillance operations against high-profile individuals demonstrates the availability of highly advanced, weaponized exploit code for this vulnerability.
Remediation
-
Update WhatsApp immediately on all devices as directed by CISA: "Apply updates per vendor instructions." Ensure all WhatsApp installations across your organization are running the latest version available from the official app stores, as the patch for CVE-2019-3568 has been available since May 2019.
-
Enable automatic app updates on all mobile devices to ensure WhatsApp and other messaging applications receive security patches promptly. For managed devices, use Mobile Device Management (MDM) solutions to enforce automatic update policies.
-
Implement mobile threat detection solutions that can identify exploitation attempts targeting messaging applications. Deploy mobile endpoint security that monitors for suspicious process behavior, unauthorized code injection, and indicators of spyware installation on managed devices.
-
Review device integrity for high-risk users who may have been targeted before the patch was applied. Check for indicators of spyware installation including unusual battery drain, unexpected data usage, suspicious background processes, and unauthorized modifications to the device's operating system.
-
Consider additional communication security measures for users handling sensitive information. Evaluate the use of devices with enhanced security configurations, implement network-level monitoring for suspicious VOIP traffic patterns, and establish protocols for secure communication in high-risk scenarios.
Technical Details
CVE-2019-3568 is a buffer overflow vulnerability (CWE-120) in WhatsApp's Voice over IP (VOIP) stack, specifically in the processing of Real-time Transport Control Protocol (RTCP) packets during call setup. The vulnerability arises from insufficient bounds checking when the WhatsApp application processes incoming RTCP packet data, where a specially crafted series of packets can cause the application to copy more data into a buffer than its allocated size allows, overwriting adjacent memory. This buffer overflow can be triggered remotely by initiating a WhatsApp voice call to the target's phone number and sending the malicious RTCP packets as part of the call signaling process, making it exploitable as a zero-click attack since the target does not need to answer or interact with the call. The code execution achieved through the buffer overflow runs with the privileges of the WhatsApp application, which on mobile platforms typically has access to contacts, messages, camera, microphone, and location data.
Frequently Asked Questions
Is CVE-2019-3568 being actively exploited?
Yes, CVE-2019-3568 has been actively exploited in the wild. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of May 10, 2022. The vulnerability was used to deploy surveillance spyware through zero-click exploitation of WhatsApp's voice calling functionality.
What products are affected by CVE-2019-3568?
CVE-2019-3568 affects Meta Platforms' WhatsApp messaging application across multiple platforms including Android and iOS. WhatsApp versions prior to the May 2019 security update are vulnerable to this buffer overflow in the VOIP stack.
How do I fix CVE-2019-3568?
Update WhatsApp to the latest version on all devices. Enable automatic app updates to ensure future security patches are applied promptly. For high-risk users, review device integrity for indicators of spyware that may have been installed before the patch was applied.
How severe is CVE-2019-3568?
CVE-2019-3568 is an extremely severe zero-click vulnerability with an EPSS percentile of approximately 97%. The buffer overflow enables remote code execution on mobile devices through WhatsApp's VOIP stack without any user interaction, and it was used in sophisticated surveillance operations against targeted individuals.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.