CVE-2020-1891 - A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices

Back Back to CVE browser

CRITICAL

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices

Published Sep 3, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.49%

Description

A user controlled parameter used in video call in WhatsApp for Android prior to v2.20.17, WhatsApp Business for Android prior to v2.20.7, WhatsApp for iPhone prior to v2.20.20, and WhatsApp Business for iPhone prior to v2.20.20 could have allowed an out-of-bounds write on 32-bit devices.

Affected products

Vendor Facebook Product WhatsApp Android Default
n/a
- Version
  2.20.17
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.17
Vendor Facebook Product WhatsApp Business for Android Default
n/a
- Version
  2.20.7
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.7
Vendor Facebook Product WhatsApp Business for iPhone Default
n/a
- Version
  2.20.20
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.20
Vendor Facebook Product WhatsApp iPhone Default
n/a
- Version
  2.20.20
  Status
  affected
  Constraints
  -
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.20

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

WhatsApp Android

n/a

Version	Status	Constraints
2.20.17	affected	-
unspecified	affected	<2.20.17

Facebook

WhatsApp Business for Android

n/a

Version	Status	Constraints
2.20.7	affected	-
unspecified	affected	<2.20.7

Facebook

WhatsApp Business for iPhone

n/a

Version	Status	Constraints
2.20.20	affected	-
unspecified	affected	<2.20.20

Facebook

WhatsApp iPhone

n/a

Version	Status	Constraints
2.20.20	affected	-
unspecified	affected	<2.20.20

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (1)

https://www.whatsapp.com/security/advisories/2020
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://www.whatsapp.com/security/advisories/2020		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner facebook

Published Sep 3, 2020

Updated Aug 4, 2024

Reserved Dec 2, 2019

Link CVE-2020-1891

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-1891

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-1891