CVE-2019-11931 - A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user

Back Back to CVE browser

HIGH

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user

Published Nov 14, 2019

7.8

HIGH

CVSS 3.1

EPSS 1.21%

Description

A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user. The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE. This affects Android versions prior to 2.19.274, iOS versions prior to 2.19.100, Enterprise Client versions prior to 2.25.3, Business for Android versions prior to 2.19.104 and Business for iOS versions prior to 2.19.100.

Affected products

Vendor Facebook Product WhatsApp Business for Android Default
unknown
Affected
- 2.19.104
- ≥ unspecified, < 2.19.104
Vendor Facebook Product WhatsApp Business for iOS Default
unknown
Affected
- 2.19.100
- ≥ unspecified, < 2.19.100
Vendor Facebook Product WhatsApp Enterprise Client Default
unknown
Affected
- 2.25.3
- ≥ unspecified, < 2.25.3
Vendor Facebook Product WhatsApp for Android Default
unknown
Affected
- 2.19.274
- ≥ unspecified, < 2.19.274
Vendor Facebook Product WhatsApp for Windows Phone Default
unknown
Affected
- ≥ unspecified, ≤ 2.18.368
Vendor Facebook Product WhatsApp for iOS Default
unknown
Affected
- 2.19.100
- ≥ unspecified, < 2.19.100

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Facebook	WhatsApp Business for Android	unknown	Affected 2.19.104 ≥ unspecified, < 2.19.104
Facebook	WhatsApp Business for iOS	unknown	Affected 2.19.100 ≥ unspecified, < 2.19.100
Facebook	WhatsApp Enterprise Client	unknown	Affected 2.25.3 ≥ unspecified, < 2.25.3
Facebook	WhatsApp for Android	unknown	Affected 2.19.274 ≥ unspecified, < 2.19.274
Facebook	WhatsApp for Windows Phone	unknown	Affected ≥ unspecified, ≤ 2.18.368
Facebook	WhatsApp for iOS	unknown	Affected 2.19.100 ≥ unspecified, < 2.19.100

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3589
Advisory
https://www.facebook.com/security/advisories/cve-2019-11931
x_refsource_CONFIRMThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3589		Advisory
https://www.facebook.com/security/advisories/cve-2019-11931		x_refsource_CONFIRMThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner facebook

Published Nov 14, 2019

Updated Aug 4, 2024

Reserved May 13, 2019

Link CVE-2019-11931

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2019-11931

Red Hat

No data

ENISA EUVD

Assigner facebook

Published Nov 14, 2019

Updated Aug 4, 2024

Link EUVD-2019-3589

GitHub

No data