CVE-2019-3568

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122 CWE-787

Affected software

Vendor	Product	Versions
Facebook	WhatsApp for Android	2.19.134; >= unspecified, < 2.19.134
Facebook	WhatsApp Business for Android	2.19.44; >= unspecified, < 2.19.134
Facebook	WhatsApp for iOS	2.19.51; >= unspecified, < 2.19.51
Facebook	WhatsApp Business for iOS	2.19.51; >= unspecified, < 2.19.51
Facebook	WhatsApp for Windows Phone	2.18.348; >= unspecified, < 2.18.348
Facebook	WhatsApp for Tizen	2.18.15; >= unspecified, < 2.18.15

References

http://www.securityfocus.com/bid/108329Broken Link, Third Party Advisory, VDB Entry
https://www.facebook.com/security/advisories/cve-2019-3568Third Party Advisory
http://www.securityfocus.com/bid/108329Broken Link, Third Party Advisory, VDB Entry
https://www.facebook.com/security/advisories/cve-2019-3568Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-3568US Government Resource

Timeline

Published: May 14, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 19, 2022
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-35697.5HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended CVE-2019-35709.8Call to the scrypt_enc() function in HHVM can lead to heap corruption by using specifically crafted parameters (N, r and p). This happens if CVE-2019-35715.3An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that wo CVE-2019-35726.5An issue was discovered in libming 0.4.8. There is a heap-based buffer over-read in the function writePNG in the file util/dbl2png.c of the CVE-2019-35735.5In libsixel v1.8.2, there is an infinite loop in the function sixel_decode_raw_impl() in the file fromsixel.c, as demonstrated by sixel2png.CVE-2019-35747.8In libsixel v1.8.2, there is a heap-based buffer over-read in the function load_jpeg() in the file loader.c, as demonstrated by img2sixel.CVE-2019-35757.8Sqla_yaml_fixtures 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in sqla_yaml_fixtures.load.CVE-2019-35769.8inxedu through 2018-12-24 has a SQL Injection vulnerability that can lead to information disclosure via the deleteFaveorite/ PATH_INFO. The CVE-2019-35779.8An issue was discovered in Waimai Super Cms 20150505. web/Lib/Action/ProductAction.class.php allows blind SQL Injection via the id[0] parame CVE-2019-35786.1MyBB 1.8.19 has XSS in the resetpassword function.CVE-2019-35795.3MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset reques CVE-2019-35807.5OpenRefine through 3.1 allows arbitrary file write because Directory Traversal can occur during the import of a crafted project file.