« Volver al listado

CVE-2021-24043

Estado: ModificadaCrítica (9.1)—

A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Whatsapp — WhatsappWhatsapp — Whatsapp Business

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24043",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve-assign@fb.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-02T12:15:07.890",
  "references": [
    {
      "url": "https://www.whatsapp.com/security/advisories/2021/",
      "tags": [
        "Not Applicable",
        "Vendor Advisory"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "https://www.whatsapp.com/security/advisories/2022/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://www.whatsapp.com/security/advisories/2021/",
      "tags": [
        "Not Applicable",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a malformed RTCP packet during an established call."
    },
    {
      "lang": "es",
      "value": "Una comprobación de límites ausente en el código de análisis de banderas RTCP anterior a WhatsApp para Android versión v2.21.23.2, WhatsApp Business para Android versión v2.21.23.2, WhatsApp para iOS versión v2.21.230.6, WhatsApp Business para iOS versión 2.21.230.7 y WhatsApp Desktop versión v2.2145.0, podría haber permitido una lectura de pila fuera de límites si un usuario enviaba un paquete RTCP malformado durante una llamada establecida"
    }
  ],
  "lastModified": "2026-06-17T03:39:12.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:2.21.23.2:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2C25B9E-58CC-4252-BD71-5BE434424C25"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:2.21.230.6:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A008CAA3-8937-4AB2-8A94-D31CFD982BC4"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:2.2145.0:*:*:*:desktop:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FCD713BE-B324-4668-B4EC-6967987DD89C"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp_business:2.21.23.2:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "54C89209-4539-4E2C-A4C3-C88489CD3D51"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp_business:2.21.230.7:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5B4676D-A585-4F23-805B-A5CC995A498B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com"
}