Critical Buffer Overflow in WhatsApp VOIP Stack (CVE‑2019‑3568) Enables Remote Code Execution
What It Is
A buffer overflow flaw resides in the Voice‑over‑IP (VOIP) stack of Meta Platforms’ WhatsApp application. By sending a specially‑crafted sequence of RTCP packets to a target phone number, an attacker can corrupt memory and execute arbitrary code on the victim’s device. The vulnerability is classified as Critical (CVSS 9.8).
Exploitability
Proof‑of‑concept code demonstrating remote code execution has been published, but there is no publicly‑confirmed evidence of widespread exploitation in the wild. The attack requires only network access to the target’s VOIP session, making it technically feasible for a motivated adversary.
Affected Products
- Vendor: Meta Platforms
- Product: WhatsApp (mobile clients on Android and iOS)
Why It Matters for Compliance & Audit Readiness
The flaw directly undermines access‑control assurance by allowing an attacker to bypass the application’s isolation and gain execution privileges on a user device. For organizations that rely on WhatsApp for business communications, the vulnerability creates a gap in continuous control monitoring and evidences a lapse in vendor‑management diligence. Mapping this risk to your access‑control framework (e.g., NIST 800‑53 AC‑2, AC‑6) and documenting remediation steps strengthens audit readiness and provides defensible evidence of due‑diligence.
Recommended Actions
- Verify that all managed devices run the latest WhatsApp version that includes the CVE‑2019‑3568 patch.
- Enforce mobile device management (MDM) policies to auto‑install updates and block outdated app versions.
- Monitor network traffic for anomalous RTCP packet patterns targeting WhatsApp VOIP sessions.
- Update your access‑control inventory to reflect the remediation status of the WhatsApp app.
- Capture evidence of patch deployment and monitoring alerts for inclusion in audit artifacts.
Source: CISA KEV – CVE‑2019‑3568