CVE-2025-55177

What it actually does

This is an authorization bypass in WhatsApp linked-device synchronization handling. Before the fixed versions, WhatsApp could accept a synchronization message from an unrelated user and process content referenced by an attacker-controlled URL on the target device. By itself, the issue is assessed as moderate severity because it abuses trust and message-routing logic rather than directly providing full device compromise. However, Meta assessed that it may have been used together with an Apple platform vulnerability, CVE-2025-43300, to force vulnerable iOS or macOS devices to process malicious remote content and trigger an OS-level exploit chain.

Why it matters to the business

The main business risk is targeted compromise of executives, journalists, administrators, legal staff, or other high-value users through WhatsApp on iOS or macOS, potentially without obvious user interaction. Successful exploitation could expose sensitive communications, credentials, files, contacts, and device telemetry if chained with spyware or an OS-level exploit. The vulnerability is listed in CISA KEV with a remediation deadline of 2025-09-23 and has been reported as actively exploited in sophisticated targeted campaigns, so organizations with managed Apple fleets or high-risk personnel should treat remediation as urgent even though the standalone CVSS score is 5.4 and EPSS is relatively low at 0.04207.

How an attack unfolds

An attacker first identifies a target who uses a vulnerable version of WhatsApp for iOS, WhatsApp Business for iOS, or WhatsApp for Mac. The attacker then abuses the incomplete authorization in linked-device synchronization messages to cause the target’s WhatsApp client to process attacker-chosen content from an arbitrary URL, despite the attacker not being an authorized linked-device participant for that account. In the reported real-world scenario, this behavior was likely paired with an Apple OS-level vulnerability so that the remotely fetched or processed content triggered a lower-level parsing or memory-safety flaw on the device. If the chain succeeds, the attacker may gain code execution or surveillance capability through the OS exploit, then collect messages, files, location data, credentials, microphone/camera access, or other sensitive information depending on the spyware payload and platform protections. Observed exploitation has been characterized as sophisticated and targeted rather than broad commodity scanning.

How to fix it

Upgrade all affected WhatsApp clients to fixed or later versions: WhatsApp for iOS v2.25.21.73 or later, WhatsApp Business for iOS v2.25.21.78 or later, and WhatsApp for Mac v2.25.21.78 or later. Also apply the relevant Apple security updates that remediate CVE-2025-43300 and any subsequent actively exploited Apple platform fixes, because the reported exploitation relied on chaining the WhatsApp authorization flaw with an OS-level vulnerability. For high-risk users, remove unknown linked devices from WhatsApp, restart devices after patching, review installed configuration profiles and device management state, and consider Apple Lockdown Mode where operationally acceptable. If compromise is suspected, preserve device evidence before wiping, then rebuild or replace the device and rotate credentials used from that device.

How to confirm the fix worked

Confirm installed WhatsApp versions on managed devices and verify they meet or exceed the fixed releases: iOS WhatsApp 2.25.21.73, iOS WhatsApp Business 2.25.21.78, and macOS WhatsApp 2.25.21.78. Confirm the underlying Apple OS is fully updated and includes the fix for CVE-2025-43300. On iOS, use MDM inventory, App Store app inventory, or device compliance reporting to validate application and OS versions. On macOS, validate application bundle version metadata and operating system build level. Review WhatsApp linked devices from the app interface and remove any unrecognized sessions. For high-risk populations, validate that network filtering, MDM compliance, and endpoint telemetry can identify outdated WhatsApp or Apple OS versions and alert on recurrence.

Typical attack path

1. Select a high-value target likely to use WhatsApp on iOS, WhatsApp Business for iOS, or WhatsApp for Mac.
2. Determine or infer that the target is running a vulnerable WhatsApp version and an unpatched Apple platform version.
3. Send or trigger a crafted linked-device synchronization message that should not be authorized for the target account.
4. Cause the target’s WhatsApp client to retrieve or process attacker-controlled content from an arbitrary URL.
5. Use malicious content to trigger a paired Apple OS-level vulnerability such as CVE-2025-43300.
6. Execute follow-on spyware or surveillance tooling on the compromised device.
7. Exfiltrate sensitive communications, contacts, files, credentials, or device metadata while attempting to avoid user-visible indicators.

How to detect it

There are no broadly published, reliable, exploit-specific indicators such as malicious URLs, file hashes, or sender identifiers for this vulnerability. Detection should focus on exposure, suspicious device behavior, and artifacts consistent with a WhatsApp-to-Apple exploit chain. Review MDM and endpoint inventory for vulnerable WhatsApp and Apple OS versions. On macOS, examine Apple Unified Logs, application crash reports, network telemetry, DNS/proxy logs, and EDR data for WhatsApp unexpectedly contacting unfamiliar external URLs, repeated WhatsApp or media-framework crashes, sandbox violations, or suspicious child processes around the time of anomalous activity. On iOS, collect MDM telemetry, device analytics, sysdiagnose where available, crash logs, VPN/DNS/proxy records, and mobile threat defense alerts. Look for unusual WhatsApp crashes, unexpected outbound connections shortly before crashes, unknown linked-device changes, configuration profile changes, suspicious VPN/proxy installation, abnormal battery or network usage, or evidence of spyware persistence. Because exploitation has been associated with sophisticated targeted campaigns, absence of logs is not proof of non-compromise; high-risk suspected cases should be escalated for specialist mobile forensics.

What your security team should do

• Immediately identify users running WhatsApp for iOS before 2.25.21.73, WhatsApp Business for iOS before 2.25.21.78, or WhatsApp for Mac before 2.25.21.78.
• Prioritize patching for executives, administrators, legal teams, security staff, journalists, human rights workers, and other users at elevated risk of targeted spyware activity.
• Ensure Apple OS updates addressing CVE-2025-43300 are installed; do not treat the WhatsApp update alone as sufficient for devices exposed to the reported exploit chain.
• Use MDM or endpoint management to enforce minimum WhatsApp and Apple OS versions and block or quarantine noncompliant devices where possible.
• Ask high-risk users to review and remove unfamiliar WhatsApp linked devices, then restart devices after updates are applied.
• Hunt for suspicious WhatsApp-related network activity, unexpected crashes, and signs of spyware on Apple devices, especially around the publication and exploitation window.
• If there are indicators of targeted compromise, preserve forensic evidence and engage mobile device forensic specialists rather than relying only on app reinstall or device wipe.
• Track CISA KEV requirements and document remediation against the 2025-09-23 deadline for regulated or government-aligned environments.