CVE-2025-55177
Meta Platforms WhatsApp Incorrect Authorization Vulnerability
Description
CVE-2025-55177 is a medium-severity incorrect authorization vulnerability in WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac. The flaw in linked device synchronization allows an unrelated user to trigger the processing of content from an arbitrary URL on a target's device. With a CVSS v3.1 base score of 5.4, the vulnerability's significance is amplified by Meta's own assessment that it may have been exploited in a sophisticated, targeted attack when combined with CVE-2025-43300, an OS-level vulnerability on Apple platforms. CISA has added CVE-2025-55177 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 23, 2025, and its EPSS score of 0.95% at the 76th percentile reflects the targeted nature of the exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| >= 2.22.25.2, < 2.25.21.73; >= 2.22.25.2, < 2.25.21.78 | ||
| whatsapp business | >= 2.22.25.2, < 2.25.21.78 |
References
- https://www.facebook.com/security/advisories/cve-2025-55177(Vendor Advisory)
- https://www.whatsapp.com/security/advisories/2025/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
CVE-2025-55177 is classified under CWE-863 (Incorrect Authorization). This weakness occurs when a product performs an authorization check but implements it incorrectly, allowing unauthorized actions to succeed. In WhatsApp's linked device synchronization mechanism, the authorization logic fails to properly validate the origin of synchronization messages, enabling an unrelated user to inject messages that trigger arbitrary URL processing on the target's device.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2025-55177 has a moderate but significant impact profile. The vulnerability is remotely exploitable over the network (AV:N) with low complexity (AC:L), requiring only low-level privileges (PR:L) and no user interaction (UI:N). Confidentiality (Low): The attacker can trigger the target's device to process content from an arbitrary URL, potentially exposing limited information such as the device's IP address, user agent, and network metadata to the attacker-controlled server. Integrity (Low): The attacker can cause unauthorized content processing on the target device, manipulating the synchronization flow to inject unintended URL requests. The scope is unchanged (S:U), and no availability impact is noted. While the standalone CVSS score of 5.4 appears moderate, Meta has explicitly warned that this vulnerability was exploited in combination with CVE-2025-43300 (an Apple platform vulnerability with a CVSS score of 10.0) in an extremely sophisticated attack against specific targeted individuals, elevating the real-world risk far beyond what the base score alone suggests.
Exploit Maturity
CVE-2025-55177 has confirmed real-world exploitation. Meta Platforms stated in their advisory that this vulnerability, in combination with CVE-2025-43300 (an Apple OS-level out-of-bounds write), "may have been exploited in a sophisticated attack against specific targeted users." CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 23, 2025. The EPSS score of 0.95% at the 76th percentile reflects a lower probability of widespread exploitation, consistent with the highly targeted nature of the attacks described by Meta. The chaining of CVE-2025-55177 with CVE-2025-43300 transforms a moderate authorization bypass into a full device compromise chain: CVE-2025-55177 triggers URL processing on the target device, and CVE-2025-43300 exploits a memory corruption flaw through a malicious image file to achieve code execution. The sophisticated attack profile suggests involvement of an advanced threat actor or commercial spyware vendor targeting high-value individuals.
Remediation
-
Update WhatsApp immediately. Upgrade to WhatsApp for iOS v2.25.21.73 or later, WhatsApp Business for iOS v2.25.21.78 or later, and WhatsApp for Mac v2.25.21.78 or later. These versions fix the incorrect authorization in the linked device synchronization mechanism.
-
Update Apple operating systems. Since this vulnerability was exploited in combination with CVE-2025-43300, ensure all Apple devices are updated to iOS 15.8.5, iPadOS 15.8.5, iOS 16.7.12, iPadOS 16.7.12, or later versions that patch the OS-level memory corruption flaw.
-
Review linked devices. Open WhatsApp Settings and review all linked devices. Remove any unrecognized or unnecessary linked devices. Re-link only the devices you actively use to minimize the attack surface.
-
Enable advanced security features. Activate WhatsApp's Lockdown Mode or any available enhanced security settings on iOS. Consider enabling Apple's Lockdown Mode on iOS and macOS for high-risk users who may be targets of sophisticated attacks.
-
Monitor for indicators of compromise. If you suspect you may have been targeted, look for unusual WhatsApp behavior such as unexpected linked device notifications, unfamiliar messages, or unusual network activity from the WhatsApp process. Consider consulting with a mobile forensics specialist, particularly if you are a journalist, activist, or other high-risk individual.
Technical Details
CVE-2025-55177 is an incorrect authorization vulnerability in WhatsApp's linked device synchronization protocol. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N indicates a network-accessible attack requiring low privileges and no user interaction, with low impact to confidentiality and integrity and no availability impact. The vulnerability exists in how WhatsApp validates synchronization messages between linked devices (such as WhatsApp Web, WhatsApp Desktop, and WhatsApp for Mac). The authorization logic incompletely verifies the sender of synchronization messages, allowing an unrelated user to craft messages that cause the target's device to fetch and process content from an attacker-specified URL. This URL processing occurs automatically without any visible notification or user interaction on the target device. When combined with CVE-2025-43300, an out-of-bounds write in Apple's image processing code, the attacker can serve a malicious image file at the arbitrary URL, triggering memory corruption and ultimately achieving code execution on the target device. Affected versions include WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS prior to v2.25.21.78, and WhatsApp for Mac prior to v2.25.21.78.
Frequently Asked Questions
Is CVE-2025-55177 being actively exploited?
Yes. Meta Platforms has confirmed that CVE-2025-55177 may have been exploited in a sophisticated, targeted attack against specific individuals. CISA has added it to the Known Exploited Vulnerabilities catalog. The attacks combined this vulnerability with CVE-2025-43300, an Apple OS-level flaw, to achieve full device compromise.
What products are affected by CVE-2025-55177?
CVE-2025-55177 affects WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS prior to v2.25.21.78, and WhatsApp for Mac prior to v2.25.21.78. The vulnerability specifically targets the linked device synchronization mechanism on Apple platforms.
How do I fix CVE-2025-55177?
Update WhatsApp to the latest version from the App Store. Also update your Apple device's operating system to patch the related CVE-2025-43300 vulnerability. Review and remove any unrecognized linked devices in WhatsApp settings.
How severe is CVE-2025-55177?
CVE-2025-55177 has a CVSS v3.1 base score of 5.4 (Medium severity) as a standalone vulnerability. However, its real-world severity is significantly higher when chained with CVE-2025-43300, which has a CVSS score of 10.0. The combination enables full device compromise on Apple platforms.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.