CVE-2025-55177 is an incomplete authorization vulnerability in WhatsApp for iOS, WhatsApp Business for iOS, and WhatsApp for Mac, allowing an unauthorized user to trigger content processing from an arbitrary URL on a target's device via linked device synchronization messages. This medium-severity vulnerability (CVSS 5.4) has a low attack complexity and could lead to limited impact on confidentiality and integrity. Critically, it has been actively exploited in sophisticated attacks against targeted users, often chained with an OS-level vulnerability on Apple platforms (CVE-2025-43300) and even a Samsung zero-day. While no public exploit code is available, the vulnerability has garnered significant community attention and media coverage, indicating its high risk and real-world exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.22.25.2, < 2.25.21.73CPE matchmatch criteria | cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:iphone_os:*:* | ||
>= 2.22.25.2, < 2.25.21.78CPE matchmatch criteria | cpe:2.3:a:whatsapp:whatsapp:*:*:*:*:*:macos:*:* | ||
>= 2.22.25.2, < 2.25.21.78CPE matchmatch criteria | cpe:2.3:a:whatsapp:whatsapp_business:*:*:*:*:*:iphone_os:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.