CVE-2025-55177

Description

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

8.0

CVSS

Severity: High

CVSS 3.1 •

Affected: Facebook WhatsApp Desktop for Mac

Affected: Facebook WhatsApp Business for iOS

Affected: Facebook WhatsApp for iOS

References

Link	Tags
https://www.whatsapp.com/security/advisories/2025/

Frequently Asked Questions

What is the severity of CVE-2025-55177?: CVE-2025-55177 has been scored as a high severity vulnerability.
How to fix CVE-2025-55177?: To fix CVE-2025-55177, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-55177 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-55177 is being actively exploited.
What software or system is affected by CVE-2025-55177?: CVE-2025-55177 affects Facebook WhatsApp Desktop for Mac, Facebook WhatsApp Business for iOS, Facebook WhatsApp for iOS.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.