CVE-2025-55177

Published Aug 29, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-55177 is a security vulnerability affecting WhatsApp for iOS (prior to version 2.25.21.73), WhatsApp Business for iOS (v2.25.21.78), and WhatsApp for Mac (v2.25.21.78). The vulnerability stems from incomplete authorization of linked device synchronization messages. This incomplete authorization could allow an attacker to trigger the processing of content from an arbitrary URL on a target's device. It has been assessed that CVE-2025-55177, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in sophisticated attacks against specific, targeted users.

Description: Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
Source: cve-assign@fb.com
NVD status: Modified
Products: whatsapp, whatsapp_business

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.4
Impact score: 2.5
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Meta Platforms WhatsApp Incorrect Authorization Vulnerability
Exploit added on: Sep 2, 2025
Exploit action due: Sep 23, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov: CWE-863

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD89DE9C-CE23-499F-8436-3DA8B2A2ECF4",
            "versionEndExcluding": "2.25.21.73",
            "versionStartIncluding": "2.22.25.2"
          },
          {
            "criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:macos:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA1A1B3A-90A5-4EA1-AC4B-715127CE9DE7",
            "versionEndExcluding": "2.25.21.78",
            "versionStartIncluding": "2.22.25.2"
          },
          {
            "criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5DE9273B-2DA9-4BCE-8840-CB0B63163646",
            "versionEndExcluding": "2.25.21.78",
            "versionStartIncluding": "2.22.25.2"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.