CVE-2018-20655: WhatsApp

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

When receiving calls using WhatsApp for iOS, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for iOS prior to v2.18.90.24 and WhatsApp Business for iOS prior to v2.18.90.24.

Affected products

• WhatsApp WhatsApp: before 2.18.90.24 (fixed in 2.18.90.24)
• WhatsApp WhatsApp Business: before 2.18.90.24 (fixed in 2.18.90.24)

Published 2019-06-14. Last modified 2026-06-17.