CVE-2025-55179
Whatsapp 2.25.8.14 – 2.25.23.83
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-55179 is a medium-severity an unspecified weakness vulnerability in Whatsapp Whatsapp. Its CVSS base score is 5.4 (Medium).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-197992
Vulnerability Data
Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another…
more
user’s device. We have not seen evidence of exploitation in the wild.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (here, rich response messages) to reject malformed or unauthorized content such as arbitrary URLs before any media processing occurs.
Enforces policy-based information flow rules that can restrict which external URLs or media sources a client is permitted to retrieve and process.
Provides mechanisms to inspect, filter, or block incoming media content that originates from untrusted or arbitrary locations before execution or rendering.