CVE-2026-23866
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could allow a user to trigger processing of media content from an arbitrary URL on another user's device, including OS-controlled custom URL scheme handlers. No evidence of exploitation in the wild has been seen.
Risk Assessment
An attacker could force a victim to process content from an arbitrary URL, potentially leading to unexpected app behavior or invocation of external handlers. No in-the-wild exploitation has been observed.
Recommendation
Update WhatsApp to the latest version available in the App Store or Google Play.
Other vulnerabilities in WhatsApp
See all- CVE-2025-55177MediumActively exploited
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device. This vulnerability, combined with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
- CVE-2019-3568CriticalActively exploited
A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.
- CVE-2025-55179Medium
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user's device. No evidence of exploitation in the wild has been observed.
Original NVD description (English source)
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS