Vulnerability details
CVE-2025-55177
Actively exploited
Facebook WhatsApp Business for iOSFacebook WhatsApp Desktop for MacFacebook WhatsApp for iOS
CVSS 3.1
5.4Medium
Remedy
Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-09-23)
Versions not listed as affected in the CVE record:
- WhatsApp Desktop for Mac — version 2.25.21.78 and later
- WhatsApp Business for iOS — version 2.25.21.78 and later
- WhatsApp for iOS — version 2.25.21.73 and later
Official description
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 5.4Medium | 3.1 | CVEProject cvelistV5 (CNA) (facebook) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WhatsApp Business for iOS | 2.22.25.2 ≤ v < 2.25.21.78 | CVEProject cvelistV5 (CNA) | |
| WhatsApp Desktop for Mac | 2.22.25.2 ≤ v < 2.25.21.78 | CVEProject cvelistV5 (CNA) | |
| WhatsApp for iOS | 2.22.25.2 ≤ v < 2.25.21.73 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://www.facebook.com/security/advisories/cve-2025-55177 x_refsource_CONFIRM
- https://www.whatsapp.com/security/advisories/2025/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177 government-resource
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-08-29
- Last updated
- 2026-10-07
- State
- Published
- Assigner (CNA)
- Kolun priority
- 72 · High
CISA KEV catalog
- Date added
- 2025-09-02
- Due date
- 2025-09-23
- Used in ransomware
- Unknown
Exploit prediction (EPSS)
13.51%
Probability of exploitation in 30 days
96.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Active
- Technical impact
- Total
Weaknesses (CWE)
- CWE-863Incorrect Authorization