CVE-2021-24043

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.whatsapp.com/security/advisories/2021/Not Applicable, Vendor Advisory
https://www.whatsapp.com/security/advisories/2022/Vendor Advisory
https://www.whatsapp.com/security/advisories/2021/Not Applicable, Vendor Advisory

Timeline

Published: Feb 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-240449.8By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would CVE-2021-240459.8A type confusion vulnerability could be triggered when resolving the "typeof" unary operator in Facebook Hermes prior to v0.10.0. Note that CVE-2021-240465.3A logic flaw in Ray-Ban® Stories device software allowed some parameters like video capture duration limit to be modified through the Facebo CVE-2021-24058.1Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). Supported versions that are affec CVE-2021-24068.1Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: User Interface). Supported versions that a CVE-2021-240668.8Microsoft SharePoint Remote Code Execution Vulnerability CVE-2021-240677.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240687.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240697.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-24075.3Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affecte CVE-2021-240707.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-240715.3Microsoft SharePoint Information Disclosure Vulnerability