CVE-2019-3568

CVE-2019-3568

Vendor Facebook
Product WhatsApp for Android
Weakness CWE-122
KEV Status Known Exploited
Published May 14, 2019
Last update October 21, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to v2.18.15.

CISA mandated remediation

02CISA Required Action

Apply updates per vendor instructions.

Key dates

03Disclosure timeline

May 14, 2019 CVE published
October 21, 2025 Record updated

Related vulnerabilities

05Related CVE

CVE-2026-30982 iccDEV has a heap out-of-bounds read in CIccPcsXform::pushXYZConvert() CVE-2023-21781 3D Builder Remote Code Execution Vulnerability CVE-2023-50739 A buffer overflow vulnerability has been identified in the Internet Printing Protocol (IPP) in various Lexmark devices. CVE-2025-40928 JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact CVE-2024-8594 Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Code Execution Vulnerability