CVE-2018-6350

Vulnerability

An out-of-bounds read vulnerability exists in WhatsApp due to incorrect parsing of RTP extension headers during voice or video calls. The flaw affects WhatsApp for Android prior to 2.18.276, WhatsApp Business for Android prior to 2.18.99, WhatsApp for iOS prior to 2.18.100.6, WhatsApp Business for iOS prior to 2.18.100.2, and WhatsApp for Windows Phone prior to 2.18.224 [1].

Exploitation

An attacker needs the ability to send a crafted RTP audio or video packet to the target device. No authentication is required, as the parsing occurs before any session encryption is processed. By manipulating the RTP extension header fields, the attacker triggers an out-of-bounds read on the receiving client [1].

Impact

Successful exploitation can lead to a denial-of-service condition (application crash) or, potentially, exposure of memory contents to the attacker. The impact is limited to information disclosure of the affected process’s memory; there is no evidence of code execution [1].

Mitigation

WhatsApp released fixed versions in 2018: for Android 2.18.276, for Android Business 2.18.99, for iOS 2.18.100.6, for iOS Business 2.18.100.2, and for Windows Phone 2.18.224. Users must update to these or later versions to remediate the issue [1].