CVE-2026-23866

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-01 · updated 2026-10-26
Weakness: CWE-940

Description

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

Affected products

Facebook WhatsApp for Android: from 2.25.8.0 through 2.26.7.10; from 2.25.8.0 through 2.26.15.72

References

https://www.facebook.com/security/advisories/cve-2026-23866
https://www.whatsapp.com/security/advisories/2026

Get alerted when CVE-2026-23866 or the next vulnerability affects your stack