CVE-2025-55177: Meta WhatsApp incorrect authorization in linked device synchronization

CVE-2025-55177 · Severity: critical · CVSS 5.4 · Exploited in the wild · Published 2025-09-02

A vulnerability in WhatsApp for Apple devices could allow an attacker to force the app to process content from a malicious web address. This issue stems from how the app synchronizes messages between linked devices. When combined with other system-level flaws, this could be used in highly targeted attacks to compromise a user's device.

Technologies: Meta Platforms WhatsApp. Vendors: Meta, Meta Platforms.

Quick answers

Is CVE-2025-55177 exploited in the wild?
Yes. CVE-2025-55177 is known to be exploited in the wild, first recorded on 2 September 2025. Treat it as urgent.
How severe is CVE-2025-55177?
Critical severity, with a CVSS score of 5.4, published 2 September 2025.
Which products and versions are affected?
Meta WhatsApp Business prior to v2.25.21.78.
Is there a fix for CVE-2025-55177?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-55177 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-55177?
Check whether you run Meta WhatsApp Business or Meta Platforms WhatsApp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in WhatsApp for iOS and macOS due to incomplete validation of linked device synchronization messages. A remote attacker with basic user privileges can send specially crafted synchronization messages that bypass authorization checks, forcing the target's device to fetch and process content from an arbitrary URL. While the CVSS score provided by the vendor is medium (5.4), the vulnerability has been observed in the wild being chained with an Apple OS-level vulnerability (CVE-2025-43300) to perform sophisticated targeted attacks. Patches are available in WhatsApp for iOS v2.25.21.73 and WhatsApp Business/Mac v2.25.21.78.

Affected products

  • Meta WhatsApp for iOS prior to v2.25.21.73
  • Meta WhatsApp Business for iOS prior to v2.25.21.78
  • Meta WhatsApp for Mac prior to v2.25.21.78

Timeline

  • 2025-08-29: disclosed
  • 2025-08-29: advisory
  • 2025-09-02: kev added: Added to CISA KEV catalog due to active exploitation.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.