CVE-2019-3568
CriticalExploitedPublic exploitA buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Published Sep 14, 2021 · Updated Oct 21, 2025 · Also known as TR-21-0733
Key Facts
Patch immediately- CVE-2019-3568 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Whatsapp, Whatsapp Business, WhatsApp Business for Android and 5 more products.
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 13, 2019. Public exploit code is available.
- EPSS estimates a 30% probability of exploitation in the next 30 days.
- Fixed versions are available, including WhatsApp Business for Android 2.19.134, WhatsApp Business for iOS 2.19.51, WhatsApp for Android 2.19.134.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
30%
Higher than 98.2% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2019-3568 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Apr 19, 2022 | May 10, 2022 | Not reported |
| Industry KEV feed | May 13, 2019 | May 10, 2022 | Not reported |
| CIRCL KEV | Apr 19, 2022 | May 10, 2022 | Not reported |
| ENISA EUVD | Apr 19, 2022 | n/a | Not reported |
Required action: Apply updates per vendor instructions.
Affected Products
12 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WhatsappWhatsapp | See advisory | 2.19.134 |
| Whatsapp BusinessWhatsapp | See advisory | 2.19.44 |
| WhatsApp Business for Android | >= 2.19.44 | 2.19.134 |
| WhatsApp Business for iOS | >= 2.19.51 | 2.19.51 |
| WhatsApp for Android | >= 2.19.134 | 2.19.134 |
Patched Releases
WhatsApp Business for Android
2.19.134
WhatsApp Business for iOS
2.19.51
WhatsApp for Android
2.19.134
WhatsApp for iOS
2.19.51
WhatsApp for Tizen
2.18.15
WhatsApp for Windows Phone
2.18.348
2.18.15, 2.18.348, 2.19.134, 2.19.51
Whatsapp Business
2.19.44, 2.19.51
Timeline
Added to Industry KEV feed
May 13, 2019
Publicly disclosed
Sep 14, 2021
Added to CISA KEV
Apr 19, 2022
Added to CIRCL KEV
Apr 19, 2022
Added to ENISA EUVD
Apr 19, 2022
Last updated
Oct 21, 2025
Weakness Type
- CWE-122 Heap-based Buffer Overflow
- CWE-787 Out-of-bounds Write
References
- advisoryhttps://apple.slashdot.org/story/21/09/13/1936213/apple-patches-a-nso-zero-day-flaw-affecting-all-devices?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+Slashdot/slashdot+(Slashdot)Apple
- advisoryhttps://indianexpress.com/article/technology/tech-news-technology/apple-issues-emergency-security-updates-to-close-pegasus-spyware-zero-click-flaw-7507300/
- advisoryhttps://indianexpress.com/article/technology/tech-news-technology/apple-issues-emergency-security-updates-to-close-pegasus-spyware-zero-click-flaw-7507300/Apple
- advisoryhttps://thehackernews.com/2021/09/apple-issues-urgent-updates-to-fix-new.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+TheHackersNews+(The+Hackers+News+-+Cyber+Security+Blog)Apple
- advisoryhttps://us-cert.cisa.gov/ncas/current-activity/2021/09/13/apple-releases-security-updates-ios-148-and-ipados-148Apple
FAQ
Common Questions.
A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number.
Affected: Whatsapp; Whatsapp Business; WhatsApp Business for Android versions >= 2.19.44, among others. The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since May 13, 2019.
Yes. It was added on Apr 19, 2022 with a federal remediation due date of May 10, 2022.
Public exploit code is available.
Fixed versions are available, including WhatsApp Business for Android 2.19.134, WhatsApp Business for iOS 2.19.51, WhatsApp for Android 2.19.134.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2019-3568 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo