CVE-2020-1891

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
FacebookWhatsApp Android2.20.17; >= unspecified, < 2.20.17
FacebookWhatsApp Business for Android2.20.7; >= unspecified, < 2.20.7
FacebookWhatsApp iPhone2.20.20; >= unspecified, < 2.20.20
FacebookWhatsApp Business for iPhone2.20.20; >= unspecified, < 2.20.20

References

Timeline

Published
Sep 3, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-189129.8An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php.CVE-2020-189137.5EARCLINK ESPCMS-P8 was discovered to contain a SQL injection vulnerability in the espcms_web/Search.php component via the attr_array parametCVE-2020-189178.8The plus/search.php component in DedeCMS 5.7 SP2 allows remote attackers to execute arbitrary PHP code via the typename parameter because thCVE-2020-18928.1Insufficient boundary checks when decoding JSON in JSON_parser allows read access to out of bounds memory, potentially leading to informatioCVE-2020-18937.5Insufficient boundary checks when decoding JSON in TryParse reads out of bounds memory, potentially leading to DOS. This issue affects HHVM CVE-2020-18948.8A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone priorCVE-2020-18957.8A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affectCVE-2020-18969.8A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.cCVE-2020-189648.8Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remoteCVE-2020-18979.8A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error hanCVE-2020-189715.5Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'CVE-2020-189725.5Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToke