CVE-2026-23866

MEDIUM

4.3

Beschreibung

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device, including triggering OS-controlled custom URL scheme handlers. We have not seen evidence of exploitation in the wild.

CVE Details

CVSS v3.1 Bewertung4.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht5/1/2026

Zuletzt geandert5/1/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-940

Referenzen

https://www.facebook.com/security/advisories/cve-2026-23866(cve-assign@fb.com)

https://www.whatsapp.com/security/advisories/2026(cve-assign@fb.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.