CVE-2020-1909 - A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution

Back Back to CVE browser

CRITICAL

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution

Published Nov 3, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.28%

Description

A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold.

Affected products

Vendor Facebook Product WhatsApp Business for iOS Default
n/a
- Version
  2.20.111
  Status
  affected
  Constraints
  -
- Version
  2.20.81
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.111
Vendor Facebook Product WhatsApp for iOS Default
n/a
- Version
  2.20.111
  Status
  affected
  Constraints
  -
- Version
  2.20.81
  Status
  affected
  Constraints
  <unspecified
- Version
  unspecified
  Status
  affected
  Constraints
  <2.20.111

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Facebook

WhatsApp Business for iOS

n/a

Version	Status	Constraints
2.20.111	affected	-
2.20.81	affected	<unspecified
unspecified	affected	<2.20.111

Facebook

WhatsApp for iOS

n/a

Version	Status	Constraints
2.20.111	affected	-
2.20.81	affected	<unspecified
unspecified	affected	<2.20.111

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-416

Use After Free

References (1)

https://www.whatsapp.com/security/advisories/2020/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://www.whatsapp.com/security/advisories/2020/		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner facebook

Published Nov 3, 2020

Updated Aug 4, 2024

Reserved Dec 2, 2019

Link CVE-2020-1909

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-1909

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-1909