Critical WhatsApp for Windows Vulnerability Allows Remote Code Execution — Update Now
WhatsApp for Windows users are being urged to update immediately following the discovery of a critical vulnerability that could allow attackers to execute malicious code simply by sending a crafted file.
The flaw, tracked as CVE-2025-30401, affects all versions of WhatsApp for Windows prior to 2.2450.6, and has now been patched by Meta.
What’s the Issue?
Meta disclosed that the vulnerability stems from a spoofing issue involving how WhatsApp for Windows handles file attachments. When a file is received, WhatsApp displays it based on its MIME type, but opens it using the file extension — a potentially dangerous mismatch.
“A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp,” Meta explained in its security advisory.
In short: attackers could disguise harmful executables as benign files (like images or documents), tricking users into launching malware with a single click.
How the Exploit Works
-
A threat actor sends a file with a mismatched MIME type and file extension.
-
WhatsApp shows the file as harmless (e.g., a JPG), based on the MIME type.
-
When opened, Windows executes the file according to the real file extension (e.g.,
.exe,.py). -
The result? Remote execution of malicious code — leading to potential data theft, spyware, or full system compromise.
This vulnerability was responsibly reported through Meta's Bug Bounty Program, though it remains unclear if it has been exploited in the wild.
Previous Security Incidents
This isn’t WhatsApp’s first brush with risky file handling bugs:
-
In July 2024, a flaw allowed Python and PHP files to execute silently if Python was installed on the system.
-
Around the same time, WhatsApp was targeted in a zero-click spyware attack using Paragon’s Graphite spyware, requiring no user interaction.
-
In a U.S. court case, Meta alleged that the NSO Group used WhatsApp zero-days to deliver Pegasus spyware to over 1,400 devices globally — including phones belonging to journalists and activists.
These events underscore the app’s value as a target for advanced surveillance and cyberattacks.
Who’s at Risk?
Anyone using WhatsApp for Windows on versions prior to 2.2450.6 is potentially vulnerable. Though no confirmed exploitation has been reported, this type of flaw is highly attractive to:
-
Cybercriminals spreading ransomware or trojans
-
Spyware developers targeting high-profile individuals
-
APT groups conducting covert surveillance
No comments:
Post a Comment