Meta Patches Two WhatsApp Vulnerabilities Targeting Media and File Handling
Meta has patched two vulnerabilities in WhatsApp that could allow attackers to manipulate media handling and disguise malicious files, though no active exploitation has been observed.
Meta has released security updates for WhatsApp to address two distinct vulnerabilities that could be leveraged to manipulate how the application handles media and file attachments. While there is currently no evidence that these flaws have been exploited in the wild, they present significant risks by lowering the barrier for social engineering attacks and potentially serving as components in more complex exploit chains Malwarebytes Labs.
The first vulnerability, tracked as CVE-2026-23866, impacts both iOS and Android versions of the messaging app. It concerns the way WhatsApp processes "rich response messages" that embed Instagram Reels. Due to incomplete validation, a specially crafted message can force the application to load media from an attacker-controlled URL. In certain scenarios, this process can trigger operating system-level custom URL scheme handlers, effectively prompting a user's device to open content from an untrusted source Malwarebytes Labs.
The second issue, identified as CVE-2026-23863, specifically affects WhatsApp for Windows versions prior to 2.3000.1032164386.258709. This vulnerability stems from the application's failure to correctly handle filenames containing embedded NUL bytes. This flaw allows an attacker to disguise a malicious executable as a benign file type within the interface. A user might believe they are opening a standard document, such as a PDF, while the system treats the file as an executable, creating a classic vector for social engineering Malwarebytes Labs.
Users are strongly encouraged to update their applications immediately to mitigate these risks. For mobile users, updates can be obtained through the Google Play Store or the Apple App Store. Windows users should verify their version by navigating to the "Help and feedback" section within their profile settings. If the version is earlier than 2.3000.1032164386.258709, users should navigate to the Microsoft Store to download the latest version, which is currently 2.3000.1038705703.261501 Malwarebytes Labs.
These vulnerabilities highlight the ongoing challenge of securing messaging platforms against sophisticated social engineering tactics. By manipulating how applications interpret file metadata or external content, attackers can bypass user intuition to deliver malicious payloads. As these bugs do not automatically infect devices, the primary defense remains user vigilance combined with timely software patching to close the gaps that attackers rely on to facilitate their campaigns Malwarebytes Labs.