CVE-2023-38538

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

Metrics

CVSS 3.1 5.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-362

Affected software

VendorProductVersions
FacebookWhatsApp Desktop for Mac< 2.2338.12
FacebookWhatsApp Desktop for Windows< 2.2320.2
FacebookWhatsApp Business for iOS< 2.23.10.77
FacebookWhatsApp for iOS< 2.23.10.77
FacebookWhatsApp Business for Android< 2.23.10.77
FacebookWhatsApp for Android< 2.23.10.77

References

Timeline

Published
Oct 4, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-38549.8A vulnerability classified as critical has been found in phpscriptpoint BloodBank 1.1. Affected is an unknown function of the file /search oCVE-2023-385417.8Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before veCVE-2023-385437.8A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attackerCVE-2023-385445.5A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability cCVE-2023-385459.8This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKCVE-2023-385463.7This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met. CVE-2023-385479.8A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access itsCVE-2023-385484.3A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-385495.4A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of CVE-2023-38556.1A vulnerability classified as problematic was found in phpscriptpoint JobSeeker 1.5. Affected by this vulnerability is an unknown functionalCVE-2023-385518.2A CRLF Injection vulnerability in Ivanti Connect Secure (9.x, 22.x) allows an authenticated high-privileged user to inject malicious code onCVE-2023-385527.5When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation a
CVE-2023-38538: Medium severity, CVSS 5.0 | Vulnix