CVE-2018-6339

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-14 · updated 2026-06-17
Weakness: CWE-121

Description

When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An off-by-one error meant that data was written beyond the allocated space on the stack. This issue affects WhatsApp for Android starting in version 2.18.180 and was fixed in version 2.18.295. It also affects WhatsApp Business for Android starting in version v2.18.103 and was fixed in version v2.18.150.

Affected products

Facebook WhatsApp for Android: from 2.18.180 before 2.18.295 — fixed in 2.18.295
Whatsapp Business: from 2.18.103 before 2.18.150 — fixed in 2.18.150

How to fix

Upgrade to a fixed version: Facebook WhatsApp for Android 2.18.295; Whatsapp Business 2.18.150. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-6339 or the next vulnerability affects your stack