ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2025-55177

KEVmass

Incorrect Authorization in WhatsApp Linked-Device Sync Used in Targeted Spyware Attacks

CISA: Meta Platforms WhatsApp Incorrect Authorization Vulnerability

CVSS 3.1
5.4 medium
EPSS
4%p90
Published
()
KEV added
AI analysis

CVE-2025-55177 is an incorrect authorization flaw (CWE-863) in how WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac validate linked device synchronization messages, allowing an unrelated user to trigger processing of content from an arbitrary URL on a target's device. An attacker can reach a vulnerable client through the messaging channel without normal authorization checks, causing the app to fetch or process attacker-chosen content. On its own the flaw carries only partial confidentiality and integrity impact (CVSS 5.4), but Meta assesses it was chained with an Apple OS vulnerability (CVE-2025-43300) in a sophisticated attack against specific, targeted users. Users running WhatsApp for iOS before 2.25.21.73, WhatsApp Business for iOS before 2.25.21.78, or WhatsApp for Mac before 2.25.21.78 are affected. The flaw was added to CISA's KEV catalog on 2025-09-02 amid reports of highly targeted zero-day attacks, though no public proof-of-concept is known and use in ransomware campaigns has not been reported.

What to do: Update WhatsApp for iOS to v2.25.21.73 or later, WhatsApp Business for iOS to v2.25.21.78 or later, and WhatsApp for Mac to v2.25.21.78 or later. Also apply Apple's backported OS fix for CVE-2025-43300, since the two flaws were combined in the observed attack chain. Review and re-link WhatsApp companion devices if compromise is suspected; federal agencies must follow BOD 22-01 required-action deadlines per the KEV listing.

Affected
Meta Platforms WhatsApp for iOSall versions prior to 2.25.21.73
Meta Platforms WhatsApp Business for iOSall versions prior to 2.25.21.78
Meta Platforms WhatsApp for Macall versions prior to 2.25.21.78
Estimated exposure
masshundreds of millions of users (WhatsApp's multi-billion user base includes a very large iOS/macOS install base) — WhatsApp reports over 2 billion global users, and the iOS and Mac client subset of that base is plausibly in the hundreds of millions, though observed exploitation has been limited to specifically targeted individuals.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

CISA Known Exploited Vulnerability
Affected
Meta Platforms WhatsApp
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date
Ransomware use
Unknown
Vendors
whatsapp
Products
whatsapp, whatsapp business
Weakness
CWE-863
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD CVE.org CISA KEV GitHub PoCs EPSS (4.2%)

In the news