CVE-2026-23863
Whatsapp ≤ 2.3000.1032164386.258709
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSummary
CVE-2026-23863 is a medium-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Whatsapp Whatsapp. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and CM-7 (Least Functionality) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-26665
Vulnerability Data
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable…
more
when opened. We have not seen evidence of exploitation in the wild.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Filename spoofing via NUL bytes directly enables masquerading (T1036) to trick users into executing malicious files (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation and sanitization of untrusted filename input to neutralize NUL bytes that enable type spoofing.
Requires malicious-code protection mechanisms that inspect attachment content and behavior rather than relying solely on the displayed filename.
Restricts execution of high-risk file types or extensions from messaging applications, limiting the impact of spoofed executables.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.