CVE-2025-55177

medium · 5.4Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Added 2025-09-02Remediation due 2025-09-23

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

5.4

CVSS

4.3%

EPSS (exploit prob.)

91st

EPSS percentile

2025-08-29

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CWE-863

Affected products

Vendor	Product	Affected versions
whatsapp	whatsapp	>= 2.22.25.2, < 2.25.21.73
whatsapp	whatsapp	>= 2.22.25.2, < 2.25.21.78
whatsapp	whatsapp_business	>= 2.22.25.2, < 2.25.21.78

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-55177