CVE-2020-1894

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A stack write overflow in WhatsApp for Android prior to v2.20.35, WhatsApp Business for Android prior to v2.20.20, WhatsApp for iPhone prior to v2.20.30, and WhatsApp Business for iPhone prior to v2.20.30 could have allowed arbitrary code execution when playing a specially crafted push to talk message.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-18957.8A large heap overflow could occur in Instagram for Android when attempting to upload an image with specially crafted dimensions. This affect CVE-2020-18969.8A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.c CVE-2020-189648.8Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote CVE-2020-18979.8A use-after-free is possible due to an error in lifetime management in the request adaptor when a malicious client invokes request error han CVE-2020-189715.5Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'CVE-2020-189725.5Exposure of Sensitive Information to an Unauthorized Actor in PoDoFo v0.9.6 allows attackers to obtain sensitive information via 'IsNextToke CVE-2020-189743.3Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows attackers to cause a denial of service via 'crc64i' in the component 'nasmlib/cr CVE-2020-189765.5Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause a Denial of Service via the 'do_checksum' function in 'checksum.c'. It can be CVE-2020-189796.1Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.CVE-2020-18987.5The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause CVE-2020-189809.8Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters.CVE-2020-189825.4Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.