CVE-2019-3568

What it actually does

Buffer overflow in the WhatsApp VOIP stack triggered by a specially crafted series of RTCP packets that leads to remote code execution on the target device.

Why it matters to the business

Attackers can fully compromise affected WhatsApp clients, enabling theft of messages and contacts, surveillance, or further lateral movement; the issue appears in CISA KEV with a past remediation deadline, increasing urgency for any remaining unpatched deployments across large user bases.

How an attack unfolds

An attacker identifies a target phone number, crafts a malicious series of RTCP packets exploiting the VOIP stack buffer overflow, and sends them over the network to achieve code execution without user interaction; the vulnerability has seen active exploitation in the wild.

How to fix it

Upgrade immediately to WhatsApp for Android 2.19.134 or later, WhatsApp Business for Android 2.19.44 or later, WhatsApp for iOS 2.19.51 or later, WhatsApp Business for iOS 2.19.51 or later, WhatsApp for Windows Phone 2.18.348 or later, and WhatsApp for Tizen 2.18.15 or later; disable VOIP features where possible until patched.

How to confirm the fix worked

Verify client version numbers against the fixed releases listed above; test by attempting to initiate VOIP calls after upgrade and confirm absence of crash or unexpected behavior on receipt of RTCP traffic.

Typical attack path

1. Resolve target phone number via WhatsApp directory or social engineering
2. Generate specially crafted RTCP packet sequence targeting the VOIP stack
3. Transmit packets to the victim's device over the WhatsApp signaling path
4. Trigger buffer overflow to gain arbitrary code execution
5. Install persistence, exfiltrate data, or pivot to other assets

How to detect it

Review network flow logs and packet captures for unusual RTCP traffic volumes or malformed packets directed at WhatsApp endpoints; examine device logs for unexpected VOIP stack crashes or process anomalies around call initiation times.

• malformed RTCP packets
• WhatsApp VOIP stack buffer overflow
• specially crafted RTCP series to phone number

What your security team should do

• Force app updates across all managed mobile devices within 48 hours
• Block or monitor outbound WhatsApp traffic from high-risk endpoints until patches are confirmed
• Add WhatsApp version checks to mobile device compliance policies
• Hunt for historical indicators of RTCP anomalies in network logs dating back to 2019