WhatsApp Addressed An Actively Exploited Zero-Day Vulnerability

1

Heads up, WhatsApp users. A serious zero-day vulnerability existed in WhatsApp that was already exploited in the wild before a fix. As confirmed, this vulnerability specifically affected WhatsApp clients for Apple devices (iOS and macOS). Since a patch has been released, users must ensure that they update their devices with the latest releases to avoid potential threats.

WhatsApp Zero-Day Vulnerability Exploited Against Apple Devices

According to a recent advisory, a major zero-day vulnerability in WhatsApp threatened the security of Apple users.

Identified as CVE-2025-55177, this vulnerability existed due to “incomplete authorization of linked device synchronization messages” in WhatsApp clients for Apple devices. Exploiting this vulnerability could allow an adversary to trigger content processing on a target user’s device. As described,

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device.

This vulnerability received a medium severity rating and a CVSS score of 5.4. While these metrics make this vulnerability less severe, it’s actually critical for users’ security given its active exploitation. WhatsApp also confirmed that the threat actors are exploiting this vulnerability by chaining it with another known flaw in Apple systems.

We assess that this vulnerability, in combination with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

The other vulnerability, CVE-2025-43300, made it to the news last month (August 2025), when Apple released patches for it. Apple defined this security flaw as an out-of-bounds (OOB) write issue arising from malicious image file processing, leading to memory corruption.

Apple patched this vulnerability by improving bounds check. It released the patch with iOS 18.6.2 and iPadOS 18.6.2, iPadOS 17.7.10,  macOS Sequoia 15.6.1, macOS Sonoma 14.7.8, and macOS Ventura 13.7.8, ensuring to address this vulnerability for most of its customers using various Apple devices.

Besides rolling out the patch, the tech giant also confirmed that it had detected its active exploitation in sophisticated attacks.

While the exact nature of those attacks remained unclear at that time, it now turns out that the vulnerability was likely chained to the WhatsApp flaw (CVE-2025-55177) for targeted spyware campaigns.

WhatsApp Notified Users Likely Affected By The Flaw

According to the head of Amnesty International’s Security Lab, Donncha Ó Cearbhaill, WhatsApp has notified its users about this threat. More specifically, it sent those notifications to the specific users likely affected by this threat. According to the images shared in his X post, the notification reads,

Our investigation indicates that a malicious message may have been sent to you through WhatsApp and combined with other vulnerabilities in your device’s operating system to compromise your device and the data it contains, including messages.
While we don’t know with certainty that your device has been compromised, we wanted to let you know out of an abundance of caution so you can take steps to secure your device and information.

In his X post, Donncha Ó Cearbhaill described this issue as a zero-click exploit. Hence, exploiting the flaw doesn’t require user interaction, indicating the stealthiness of the threat.

While WhatsApp confirmed patching the vulnerability, it also warned users of a continued device compromise in case they have already been impacted by the malware. Hence, WhatsApp urged users to perform a full device factory reset.

For now, it remains unclear as to what specific malware or spyware campaign exploited these flaws. However, WhatsApp vulnerabilities have long been a potential attack vector for targeted spyware campaigns, such as NSO’s Pegasus, as they provide a sneaky way to infiltrate the largely secure Apple devices.

Let us know your thoughts in the comments.