Type Vulnerability
Meta Platforms WhatsApp contains an incorrect authorisation vulnerability due to an incomplete authorisation of linked device synchronisation messages. Known-exploited catalogue reports exploitation in the wild.
Meta Platforms
Meta Platforms WhatsApp Authorisation Flaw Vulnerability
CVE-2025-55177
What this means
This is rated medium severity (5.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Whatsapp Whatsapp and Whatsapp Whatsapp Business are in your estate.
Full vendor description
Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.
Scoring and exploitation
5.4/ 10
CVSS 3.1 base scoreMedium
Exploitable over the network with a low-privilege account, and no one has to click or open anything. Low impact on confidentiality and integrity.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityLowC:L
IntegrityLowI:L
AvailabilityNoneA:N
- Elevated attack likelihood (~13.5% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Meta Platforms WhatsApp
Weaknesses
CWE-863
Affected products ()
- Whatsapp Whatsapp
- Whatsapp Whatsapp Business
Show the raw CPE strings (3)
- cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:*
- cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:macos:*:*
- cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:*
References
3 links from the CVE record, grouped by site; the vendor's advisory comes first.
facebook.com1 linkVendor advisory
- cve-2025-55177 (opens in a new tab)Vendor Advisory
whatsapp.com1 linkVendor advisory
- 2025 (opens in a new tab)Vendor Advisory
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource