CVE-2019-11927

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-27 · updated 2026-06-17
Weakness: CWE-190

Description

An integer overflow in WhatsApp media parsing libraries allows a remote attacker to perform an out-of-bounds write on the heap via specially-crafted EXIF tags in WEBP images. This issue affects WhatsApp for Android before version 2.19.143 and WhatsApp for iOS before version 2.19.100.

Affected products

Facebook WhatsApp for Android: before 2.9.143; before 2.19.100 — fixed in 2.19.100, 2.9.143

How to fix

Upgrade to a fixed version: Facebook WhatsApp for Android 2.19.100, 2.9.143. Check the vendor advisory for mitigations.

References

https://www.facebook.com/security/advisories/cve-2019-11927
https://www.facebook.com/security/advisories/cve-2019-11927

Get alerted when CVE-2019-11927 or the next vulnerability affects your stack