{"id":"CVE-2025-55177","published":"2025-08-29T16:15:36Z","modified":"2026-10-18T21:10:00Z","title":"Meta Platforms WhatsApp Incorrect Authorization Vulnerability","vendor":"Meta Platforms","product":"WhatsApp","tier":"core","eol":null,"description":{"text":"Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an incorrect authorization issue in the linked device synchronization messaging of Meta Platforms' WhatsApp, affecting WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac. An attacker with a network-reachable path and low-privilege access can exploit it without user interaction, since the incomplete authorization check lets an unrelated user cause the target's device to process content fetched from an arbitrary URL, which would partially compromise confidentiality and integrity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:14:26Z"},"cvss":{"score":5.4,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.13513,"percentile":0.9644,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-09-02","dueDate":"2025-09-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.whatsapp.com/security/advisories/2025/ ; https://nvd.nist.gov/vuln/detail/CVE-2025-55177","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-20","exploitedFirstSeen":"2025-08-20","ransomware":false,"evidence":[{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","date":"2025-08-20"},{"url":"https://www.whatsapp.com/security/advisories/2025/","date":"2025-08-29"},{"url":"https://socprime.com/blog/latest-threats/cve-2025-55177-vulnerability/","date":"2025-09-02"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-09-02"},{"url":"https://unit42.paloaltonetworks.com/landfall-is-new-commercial-grade-android-spyware/","date":"2025-11-07"},{"url":"https://www.rapid7.com/cdn/assets/bltbd2f1cd70f9e3e7f/691360b9c91291146f1a5308/threat-landscape-report-q3-2025.pdf","date":"2025-11-12"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"},{"url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2026-CTI-002.pdf","date":"2026-03-13"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"references":[{"url":"https://www.facebook.com/security/advisories/cve-2025-55177","tags":["Vendor Advisory"]},{"url":"https://www.whatsapp.com/security/advisories/2025/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55177","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unrelated user exploits app via crafted sync messages","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device","start":181,"end":293}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary URL content fetched onto the device","mappingType":"primary_impact","evidence":[{"from":"description","quote":"trigger processing of content from an arbitrary URL on a target’s device","start":221,"end":293}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-26214","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26214","exploited":true,"exploitedSince":"2025-09-02","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-04-24","earliestUrl":"https://github.com/danielw98/zero-click-exploit-analysis","repos":[{"name":"danielw98/zero-click-exploit-analysis","url":"https://github.com/danielw98/zero-click-exploit-analysis","stars":6,"created":"2026-04-24"}]},"first":{"date":"2026-04-24","source":"PoC-in-GitHub","url":"https://github.com/danielw98/zero-click-exploit-analysis"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1105"],"provenance":"ai"}],"timeline":[{"date":"2025-08-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","provenance":"source"},{"date":"2025-08-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55177","provenance":"source"},{"date":"2025-09-02","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-09-02","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-26214","provenance":"source"},{"date":"2026-04-24","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/danielw98/zero-click-exploit-analysis","provenance":"source"}],"speed":{"daysToPublicExploit":238,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":66.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 436 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.29,"detail":"percentile 0.9644"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":3.78,"detail":"base score 5.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}