CVE-2018-6350

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Facebook	WhatsApp for Android	2.18.276; >= unspecified, < 2.18.276
Facebook	WhatsApp Business for Android	2.18.99; >= unspecified, < 2.18.99
Facebook	WhatsApp for iOS	2.18.100.6; >= unspecified, < 2.18.100.6
Facebook	WhatsApp Business for iOS	2.18.100.2; >= unspecified, < 2.18.100.2
Facebook	WhatsApp for Windows Phone	2.18.224; >= unspecified, < 2.18.224

References

http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/Third Party Advisory
http://www.securityfocus.com/bid/108803
https://www.facebook.com/security/advisories/cve-2018-6350/Third Party Advisory

Timeline

Published: Jun 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-63525.5In PoDoFo 0.9.5, there is an Excessive Iteration in the PdfParser::ReadObjectsInternal function of base/PdfParser.cpp. Remote attackers coul CVE-2018-63537.8The Python console in Electrum through 2.9.4 and 3.x through 3.0.5 supports arbitrary Python code without considering (1) social-engineering CVE-2018-63546.1templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.CVE-2018-63556.1/goform/setLang on iBall 300M devices with "iB-WRB302N_1.0.1-Sep 8 2017" firmware has Unauthenticated Stored Cross Site Scripting via the la CVE-2018-63566.5Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs CVE-2018-63578.8The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via th CVE-2018-63588.8The printDefineFont2 function (util/listfdb.c) in libming through 0.4.8 is vulnerable to a heap-based buffer overflow, which may allow attac CVE-2018-63598.8The decompileIF function (util/decompile.c) in libming through 0.4.8 is vulnerable to a use-after-free, which may allow attackers to cause a CVE-2018-63608.8mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDE CVE-2018-63616.1Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the op parameter, as demonstrated by adding a backdoor FTP account.CVE-2018-63626.1Easy Hosting Control Panel (EHCP) v0.37.12.b has XSS via the domainop action parameter, as demonstrated by reading the PHPSESSID cookie.CVE-2018-63639.8SQL Injection exists in Task Rabbit Clone 1.0 via the single_blog.php id parameter.