4.3Mittel
CVE-2026-23866
Beschreibung
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.
Schwachstellentyp (CWE):
CWE-940
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| WhatsApp for Android | 2.25.8.0 – < 2.26.7.10 | ||
| WhatsApp for iOS | 2.25.8.0 – < 2.26.15.72 | ||
| 2.25.8.0 – ≤ 2.26.7.10 |
Referenzen und Patches
- https://www.facebook.com/security/advisories/cve-2026-23866 Third Party Advisory
- https://www.whatsapp.com/security/advisories/2026 Vendor Advisory
CPE-Treffer (NVD) (2)
cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:android:*:*≥ 2.25.8.0 ≤ 2.26.7.10cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*≥ 2.25.8.0 ≤ 2.26.15.72