CVE-2018-6349: WhatsApp

Critical severity, CVSS 9.8. EPSS: 2.2% chance of exploitation in the next 30 days.

When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflow. This issue affects WhatsApp for Android prior to 2.18.248 and WhatsApp Business for Android prior to 2.18.132.

Affected products

• WhatsApp WhatsApp: before 2.18.248 (fixed in 2.18.248)
• WhatsApp WhatsApp Business: before 2.18.132 (fixed in 2.18.132)

Published 2019-06-14. Last modified 2026-06-17.