« Volver al listado

CVE-2025-55179

Estado: AnalizadaMedia (5.4)—

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Whatsapp — WhatsappWhatsapp — Whatsapp Business

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-55179",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-55179",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-18T14:22:05.852548Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve-assign@fb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve-assign@fb.com",
      "affectedData": [
        {
          "vendor": "Facebook",
          "product": "WhatsApp Business for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "2.25.8.14",
              "lessThan": "2.25.23.82",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "vendor": "Facebook",
          "product": "WhatsApp for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "2.25.8.17",
              "lessThan": "2.25.23.73",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Facebook",
          "product": "WhatsApp Desktop for Mac",
          "versions": [
            {
              "status": "affected",
              "version": "2.25.8.14",
              "lessThan": "2.25.23.83",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-11-18T15:16:32.177",
  "references": [
    {
      "url": "https://www.facebook.com/security/advisories/cve-2025-55179",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve-assign@fb.com"
    },
    {
      "url": "https://www.whatsapp.com/security/advisories/2025/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve-assign@fb.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen evidence of exploitation in the wild."
    }
  ],
  "lastModified": "2026-06-17T09:41:24.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05D8407F-8992-483D-A0DA-647C1291378D",
              "versionEndExcluding": "2.25.23.83",
              "versionStartIncluding": "2.25.8.14"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "332FD04C-066B-4A88-8F85-AAE1BCBE3B48",
              "versionEndExcluding": "2.25.23.73",
              "versionStartIncluding": "2.25.8.17"
            },
            {
              "criteria": "cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5542D196-8D14-483A-ABAB-0A85EAF6FD82",
              "versionEndExcluding": "2.25.23.82",
              "versionStartIncluding": "2.25.8.14"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com"
}