CVE-2026-23863
Medium · 6.5CVSS
6.5
EPSS
0.5%
Published
May 1, 2026
CISA due date
—
The record
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the application as one type of file but run as an executable when opened. We have not seen evidence of exploitation in the wild.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-76354 In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does… CWE-158
- CVE-2026-47778 Envoy is an open source edge and service proxy designed for cloud-native applications. CWE-158
- CVE-2026-43895 jq is a command-line JSON processor. CWE-158
- CVE-2026-41256 jq is a command-line JSON processor. CWE-158
- CVE-2026-43859 mutt before 2.3.2 sometimes uses strfcpy instead of memcpy for the IMAP auth_cram MD5… CWE-158
- CVE-2026-43861 mutt before 2.3.2 does not check for '\0' in url_pct_decode. CWE-158
- CVE-2026-33191 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-158
- CVE-2025-14388 The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read… CWE-158